2 ms·

I think the web is full of SQL vulnerabilities because lots of people do not understand that there is a problem with using user submitted data without some kind

I think the web is full of SQL vulnerabilities because lots of people do not understand that there is a problem with using user submitted data without some kind of tested sensitization method calls that are not homebrew. In all reality they should be using stored procs with named parameters dynamic sql queries are usually hard to do right(depends on the language, php makes it hard). If you use a stored procedure for user auth and the input comes in as x'; drop table users;-- the system will not drop the tables because the parameters get auto quoted.

bretpiatt 17y ago
It isn't just SQL vulnerabilities though your comment reminded me of the best XKCD of all time (in the opinion of this man): http://xkcd.com/327/ http://xkcd.com/327/ [Exploits of a Mom] Programmers are taught in school how to build software that works for expected user behavior. Security vulnerabilities don't come from expect behavior or a check would be in place to prevent it. We need to push to have a software security class added to all CSCI degree programs. Force people to have at least a semester of looking at how to break things.
scotty79 17y ago
You could easily design language that would prevent most cases of sql vulnerabilities. It would only need SQL as first class datatype with it's own literals (let's say sql""). It should not be concatenable with strings. Strings should not be easily convertible to SQL datatype. Any other data should mix with SQL only trough formatting operator (let's say %). Formatting operator should of course provide proper escaping by default. You'd had to write: mysql_query(sql"SELECT * FROM table WHERE id = ?" % $id); instead of mysql_query("SELECT * FROM table WHERE id = ".$id); because mysql_query() would require parameter of type sql (not string) and you could not concatenate sql with anything else. Similarly you could prevent XSS attacks by making HTML first class datatype. You could even have native simple templating engine built into formatting operator for HTML. Stored procedures are bad because they are not straightforward. You can't expect people to keep off the grass and walk around while the shortest path leads directly through the lawn. Guy responsible for PHP coming up and saying to PHP developers "The Web is broken and it's all your fault." (http://www.internetnews.com/bus-news/article.php/3631831 http://www.internetnews.com/bus-news/article.php/3631831 ) pisses me off a bit.

bretpiatt 17y ago

It isn't just SQL vulnerabilities though your comment reminded me of the best XKCD of all time (in the opinion of this man): http://xkcd.com/327/ http://xkcd.com/327/ [Exploits of a Mom] Programmers are taught in school how to build software that works for expected user behavior. Security vulnerabilities don't come from expect behavior or a check would be in place to prevent it. We need to push to have a software security class added to all CSCI degree programs. Force people to have at least a semester of looking at how to break things.

scotty79 17y ago

You could easily design language that would prevent most cases of sql vulnerabilities. It would only need SQL as first class datatype with it's own literals (let's say sql""). It should not be concatenable with strings. Strings should not be easily convertible to SQL datatype. Any other data should mix with SQL only trough formatting operator (let's say %). Formatting operator should of course provide proper escaping by default. You'd had to write: mysql_query(sql"SELECT * FROM table WHERE id = ?" % $id); instead of mysql_query("SELECT * FROM table WHERE id = ".$id); because mysql_query() would require parameter of type sql (not string) and you could not concatenate sql with anything else. Similarly you could prevent XSS attacks by making HTML first class datatype. You could even have native simple templating engine built into formatting operator for HTML. Stored procedures are bad because they are not straightforward. You can't expect people to keep off the grass and walk around while the shortest path leads directly through the lawn. Guy responsible for PHP coming up and saying to PHP developers "The Web is broken and it's all your fault." (http://www.internetnews.com/bus-news/article.php/3631831 http://www.internetnews.com/bus-news/article.php/3631831 ) pisses me off a bit.