Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How not to protect against SQL injection (view source)

cadw.wales.gov.uk

Post reply on HN
Print view View original

91–100 of 125 posts

Re: How not to protect against SQL injection (view source)

#91

Post by fghjrjrt »

ONLINE STORE: ====== ( http://www.fullmalls.com )====

====== ( http://www.fullmalls.com )====

Air jordan(1-24)shoes $30

Handbags(Coach l v f e n d i d&g) $35

Tshirts (Polo ,ed hardy,lacoste) $15

Jean(True Religion,ed hardy,coogi) $30

Sunglasses(Oakey,coach,gucci,A r m a i n i) $15

New era cap $12

Bikini (Ed hardy,polo) $20

accept paypal and free shipping

====== ( http://www.fullmalls.com )====

====== ( http://www.fullmalls.com )====

====== ( http://www.fullmalls.com )====

====== ( http://www.fullmalls.com )====

====== ( http://www.fullmalls.com )====

====== ( http://www.fullmalls.com )====

====== ( http://www.fullmalls.com )====

====== ( http://www.fullmalls.com )====

Re: How not to protect against SQL injection (view source)

#93

Post by tajddin »

teichman wrote: post #89

So for those of use who know nothing about websites: what is the correct way to protect against SQL injection?

Generally, on the server-side, you parameterize the query. Depending on the server-side language, a normal SQL query that would read SELECT * FROM myTable WHERE lastName = 'Smith' would be converted to something like SELECT * FROM myTable WHERE lastName = @lastnameparam. Then in code, you'd supply the value of @lastnameparam as 'Smith'.

It depends on the language, but this is what you'd do in .NET, for example. In this case, the framework does the work for you by encoding the value of lastnameparam (it makes sure that whatever is supplied to lastnameparam isn't read as SQL).

Re: How not to protect against SQL injection (view source)

#94

Post by dwwoelfel »

mixmax wrote: post #78
Stormbringer wrote: post #77

Earlier quoted context omitted.

I've got $10 riding on "they see the word Hacker in 'Hacker News' and start freaking out". :D Oh, I understand the word hacker in all its culturally and context relevant forms, and you understand the word hacker, but they do not understand the word hacker. :-(

That's why we have to tell them. If we, as hackers of the sort that inhabit hacker news, have a post like this on the frontpage and noone cares to actually write them and tell them they have a security problem that may cause them serious damage we don't deserve better.

Perhaps an anonymous email would have been safer.

Edit: But your email is very amiable and clear, so I think you're probably safe.

Re: How not to protect against SQL injection (view source)

#95

Post by pyre »

teichman wrote: post #89

So for those of use who know nothing about websites: what is the correct way to protect against SQL injection?

Well, since it wasn't necessarily answered explicitly anywhere, you don't want your validation code to run on the client (i.e. the browser) because the end-user has absolute control and can easily circumvent your controls. You have to protect yourself on the server-side where you have control.

Re: How not to protect against SQL injection (view source)

#96

Post by sbierwagen »

steve-howard wrote: post #25
Skalman wrote: post #18

Earlier quoted context omitted.

I don't think SQL is a bad API - it's just that every language makes it so difficult to use prepared statements! It shouldn't be harder than: sql_query('SELECT * FROM mytable WHERE name = ?', name) (I'm aware that this defeats the purpose of prepared statements to be reusable - this is just an API that's better than the current methods)

The side benefit of prepared statements, perhaps even more importantly if security is not really your concern, is that you don't need a password page that looks like this (this is really the password requirements page for my school): A password must: be 6-8 characters in length. contain a non-alphanumeric character such as ( ! ] & * , + = A password cannot: ... include a dollar sign ( $ ), a single quote ( ‘ ), a dou…

Fun fact: Etrade won't let you use a period ( . ) in a password. No error or anything, account creation just silently fails.

Re: How not to protect against SQL injection (view source)

#97

Post by damncabbage »

cosmok wrote: post #73
tptacek wrote: post #29

Earlier quoted context omitted.

This is the second time in a few days someone has made the point that web stacks make it hard to use prepared statements†. This is a one-liner in Rails. Does it not work in Python? How hard is it in PHP? † Which are not a cure-all for SQLI .

Very easy in PHP. http://php.net/manual/en/pdo.prepared-statements.php

Except when the database drivers PDO relies on aren't set up by default:

http://news.ycombinator.com/item?id=2376873

Re: How not to protect against SQL injection (view source)

#98

Post by DisposaBoy »

derleth wrote: post #72
mixmax wrote: post #60

I just fired off an e-mail to point out that they have a potentially serious security problem and they should get it fixed ASAP. I see this as a civic duty, and think that this is the kind of action you're required to perform if you see a serious problem. Writing an e-mail takes ten seconds, but the potential damage could well cost serious money.

If you're lucky, you aren't in the UK so they won't be able to arrest you instantly on the hacking charges. If you're very lucky, the place you are in won't honor their demands for extradition on the hacking charges.

This comment is way too cynical for confort and to be honest I think it's pretty baseless.

1. There is a potential risk of SQL injection here - as far as I see, it's more likely that there is in-fact none.

2. You imply you're living in the UK, if there was an issue who do you think would suffer? Do you think the PM, etc. etc. pays for services like this their own money...

3. This idea that you might get arrested for informing them about something like this is just plain silly - it's ridiculous. What exactly can you possibly be charged with here?

Re: How not to protect against SQL injection (view source)

#99

Post by flexd »

mixmax wrote: post #74
derleth wrote: post #72

Earlier quoted context omitted.

If you're lucky, you aren't in the UK so they won't be able to arrest you instantly on the hacking charges. If you're very lucky, the place you are in won't honor their demands for extradition on the hacking charges.

No offense, but I think you're a tad paranoid. If I was a mechanic and I saw someone at a gasstation driving a car that was obviously dangerous because of some kind of bad fixup I would tell him. This is no different, and I don't expect anyone to sue me for that. Here's the mail I sent: Hi there, It appears that you have some pretty severe security problems on your site. This is a heads up so you can get it fixed. I…

I sent a email when i saw it too.
Post reply on HN