4 ms·
Do people really use variables based on raw userdata to select table/columns? Seems like an incredibly rare case, and bad design. I've never seen/used it. Para
by axod 17y ago
Do people really use variables based on raw userdata to select table/columns? Seems like an incredibly rare case, and bad design. I've never seen/used it.
Parameterized queries are a magic totem against injection, unless you mix them with concatenation of unclean userdata. Which would be silly.
- tptacek 17y agoOf course they do. Sort columns send "ASC" and "DESC", pagination limits and offsets are sent in offset= parameters, etc. How else do you think people do it, other than the most obvious way? Don't make the problem even worse than it is by trying to downplay it just because you know what you're doing.
- axod 17y agoOK you got me on those 2 cases. For sort order: $sort_order=="ASC"?"ASC":"DESC" For offsets and limits convert/parse it to a number first and ensure it's within sane bounds. You're right though. Parameterization isn't a magic bullet that allows you to forget about all other unclean data if you're using other unclean data in an SQL query. Surely we all know this though? :/
- tptacek 17y agoMy advice is, pass page= as your pagination and pass 1/0 in for ASC or DESC. If you have selectable columns, number them in the parameters, don't name them. Point being, when you compose the query, you should never be inserting text from parameters; you should be converting parameters into known-good values.