3 ms·
Properly implemented parameterized SQL would allow '; drop table users; -- As a password without batting an eye.
by Zikes 13y ago
Properly implemented parameterized SQL would allow
'; drop table users; --
As a password without batting an eye.
- sp332 13y agoBut since you can't guarantee that every programmer and contractor, including future ones, write proper SQL, it's nice to reduce the attack surface a bit.
- KMag 13y agoReduce the attack surface by running the password through a proper modern Key Derivation Function (KDF) such as Scrypt before passing it to the database, not by running it through a few regexes.
- CocaKoala 13y agohey man don't post my password here. Now I gotta change it again and I'm running out of good sql queries.
- BoppreH 13y agoUnless I'm missing something here, lacking parametrization is not the issue here. The issue is that it's obvious they are saving the password in plaintext instead of hashing it, otherwise the password would never get close to an SQL query to allow injection.