4 ms·
Above you are essentially saying every application has SQL injection vulnerabilities and any good security guy will find them. This is a very specific and dubio
by fusiongyro 14y ago
Above you are essentially saying every application has SQL injection vulnerabilities and any good security guy will find them. This is a very specific and dubious conclusion to draw from the more general principle that there will be some vulnerability, somewhere. SQL injection specifically is quite easy to avoid. With some frameworks it would actually be rather laborious to introduce an SQL injection vulnerability. This is what Alexander is alluding to. This does not imply that applications are easily secured, just that this attack vector isn't what it used to be.
- PeterisP 14y agoWell, statistics of pentests does show that, if tested, the vast majority of good quality, generally securely built applications have some vulnerabilities, and average applications have a huge multitude of vulnerabilities. SQL injections are just one class of many. There are ways to vastly reduce SQL injection risks but that still leaves many other venues of attack.