4 ms·
I think $sth = $dbh->prepare("SELECT document FROM table WHERE tag=? AND security_level=?"); $sth->execute(foo(), $user_level); breaks as well, if foo
by OMGWTF 12y ago
I think
$sth = $dbh->prepare("SELECT document FROM table WHERE tag=? AND security_level=?");
$sth->execute(foo(), $user_level);
breaks as well, if foo() unexpectedly returns a list.
- sarciszewski 12y agoBreaks as in "SQL injection is possible" or breaks as in "invalid number of parameters"?
- OMGWTF 12y agoIf the list contains 2 elements, it will overwrite the second parameter, so the total number of arguments is still the same.
- laumars 12y agoAh yes, but that's a slightly different feature to the one demonstrated by the author (https://www.youtube.com/watch?feature=player_detailpage&v=gweDBQ-9LuQ#t=1012 https://www.youtube.com/watch?feature=player_detailpage&v=gw...). However that's not to say that the vulnerability you raised isn't also a serious one developers need to be mindful of.
- danielki 12y agoThe following won't break (at least not in the bad way), I don't think: $sth = $dbh->prepare("SELECT document FROM table WHERE tag=? AND security_level=?"); $sth->bind_param(1,foo()); $sth->bind_param(2, $user_level); $sth->execute();
- pwr22 12y agoIndeed it looks like it can, but this is still a non-issue if you understand context (a key feature of Perl) and know what foo does