3 ms·
You're probably doing something wrong if you're using user input to construct table names and field names. I can see why this might be necessary in some cases
by kijin 14y ago
You're probably doing something wrong if you're using user input to construct table names and field names.
I can see why this might be necessary in some cases (e.g. year and month in the name of the table), but such cases can be handled relatively easily by using a whitelist and/or validating & sanitizing strictly. If user input needs to be escaped rather than validated & sanitized, you're still doing something wrong. Why would you even have a table name or field name that doesn't match /[a-z0-9_]+/i ?
- wglb 14y agoYou're probably doing something wrong if you're using user input to construct table names and field names. This is possibly true. Far more common is to offer the user a drop-down list of field name choices. In that case, the server side should whitelist valid field names before building the sql statement.
- pyre 14y agoBetter yet, hard-code the list on the server-side, and have the form only submit an index value to the list (and protect against overflows if necessary in your language/framework of choice). Forcing a translation between the integer and the field name protects against screwing up the white-list somehow and allowing arbitrary input.