How not to protect against SQL injection (view source)
cadw.wales.gov.uk
How not to protect against SQL injection (view source)
1–10 of 125 posts
Re: How not to protect against SQL injection (view source)
#2I'm going to assume that they have a server-side validation script running and the client side code is just to prevent/explain to mistaken users and if the server-side script every activates they know that someone's being malicious.
Re: How not to protect against SQL injection (view source)
#3[deleted]
Re: How not to protect against SQL injection (view source)
#4I'm going to assume that they have a server-side validation script running and the client side code is just to prevent/explain to mistaken users and if the server-side script every activates they know that someone's being malicious.
I was thinking the same thing. Let's hope that's true.
Re: How not to protect against SQL injection (view source)
#5This is a great example of why a little knowledge is a dangerous thing.
Re: How not to protect against SQL injection (view source)
#6I'm going to assume that they have a server-side validation script running and the client side code is just to prevent/explain to mistaken users and if the server-side script every activates they know that someone's being malicious.
Right, I tried searching for "select" and it just redirected me back to the home page.
Re: How not to protect against SQL injection (view source)
#7I'm going to assume that they have a server-side validation script running and the client side code is just to prevent/explain to mistaken users and if the server-side script every activates they know that someone's being malicious.
http://www.reddit.com/r/programming/comments/gdviz/how_not_t...
Based on some of the comments there, it doesn't look like it (or at least, it wasn't there several hours ago when Reddit stumbled upon the site). See http://www.reddit.com/r/programming/comments/gdviz/how_not_t... for some examples.
Re: How not to protect against SQL injection (view source)
#8I'm going to assume that they have a server-side validation script running and the client side code is just to prevent/explain to mistaken users and if the server-side script every activates they know that someone's being malicious.
I was thinking the same thing. Let's hope that's true.
It would seem kind of stupid if they were smart enough to implement validation but not smart enough to limit user access to it. Of course there's no accounting for the depths of stupidity.
Re: How not to protect against SQL injection (view source)
#9Since they're using SQL Server (hint is that they are checking for "xp_"), you can get a list of all of their databases with "SELECT name FROM sys.databases", then loop through and drop them. Hope the web login doesn't have drop permissions.
Re: How not to protect against SQL injection (view source)
#10I'm going to assume that they have a server-side validation script running and the client side code is just to prevent/explain to mistaken users and if the server-side script every activates they know that someone's being malicious.
Maybe the javascript is intentional, like a honeypot for hackers :)