Y
HN Search
Hacker News Search
new
|
comments
|
top
|
jobs
AlbertQQA
searching PlanetScale…
1.
▲
2.
▲
3.
▲
4.
▲
5.
▲
6.
▲
4 ms
·
1.
▲
by
AlbertQQA
9y ago
All I'm seeing is a missing db_like which means a user can search for "%foo%bar%" instead of just "foo%bar". This is not a SQL-injection, nor a relevant issue. The problem is in that function though. It is missing a
2.
▲
by
AlbertQQA
9y ago
> Took hardly any time to see the SQL injection. You sure you saw it correctly? Concatenation of hardcoded variants (poor-mans query builder) doesn't make an injection.