Optimistically, perhaps this requirement stems from an overzealous WAF
What does WAF stand for?
Web Application Firewall
Password may not contain: select, insert, update, delete, drop
21–30 of 254 posts
Re: Password may not contain: select, insert, update, delete, drop
#22For people wondering how to do this properly it's called parametrized queries.
Re: Password may not contain: select, insert, update, delete, drop
#23Re: Password may not contain: select, insert, update, delete, drop
#24Re: Password may not contain: select, insert, update, delete, drop
#25Earlier quoted context omitted.
Actually they do sanitization by blacklisting "Blacklist sanitizing cleans the input by removing unwelcomed characters such as line breaks, extra white spaces, tabs, &, and tags." But still this is not a way, input sanitization is bullshit. Using query parameters, thus inserting raw input into already built abstract syntax tree of SQL query is the correct solution since SQL injection is about affecting tree compositi…
You don't even have to do that, just escape single quotes and you've defeated everything but homomorphic attacks as far as I can tell.
Why use unreliable solutions that rely on various assumptions that may change in the future and rely on you not forgetting about even 1 case where it wouldnt work
When you can use approach which fundamentally prevents SQL injection?
Re: Password may not contain: select, insert, update, delete, drop
#26Earlier quoted context omitted.
That, or some poorly architectured "framework" or toolkit. Others in the comments see this as "proof" that the application has poor security. I don't think we can draw that conclusion. We can, however, draw the conclusion that some part of the stack is poorly implemented.
I mean, this is a gross misunderstanding of how user input makes its way into a database safely. If you're putting out error messages like this it's a giant red flag.
And top of that, password should NEVER be stored to database
Re: Password may not contain: select, insert, update, delete, drop
#27Earlier quoted context omitted.
That, or some poorly architectured "framework" or toolkit. Others in the comments see this as "proof" that the application has poor security. I don't think we can draw that conclusion. We can, however, draw the conclusion that some part of the stack is poorly implemented.
I mean, this is a gross misunderstanding of how user input makes its way into a database safely. If you're putting out error messages like this it's a giant red flag.
It is also very common not to do things right. https://www.bbc.com/future/article/20160325-the-names-that-b...
That article is a few years old now and things should have got better, but even by 2016 everyone should have known properly sanitising inputs was critical for a decade or two.
Re: Password may not contain: select, insert, update, delete, drop
#28For people wondering how to do this properly it's called parametrized queries.
You mean storing plain text passwords in a database is safe?
Re: Password may not contain: select, insert, update, delete, drop
#29Earlier quoted context omitted.
I mean, this is a gross misunderstanding of how user input makes its way into a database safely. If you're putting out error messages like this it's a giant red flag.
And top of that, password should NEVER be stored to database
Well, not in plaintext.
Re: Password may not contain: select, insert, update, delete, drop
#30All five words are also common English words found in any major dictionary. If you're not actually doing anything stupid with the passwords, all you have to do is use that same diagnostic for that situation: "password may not contain dictionary words". Then you don't have a diagnostic which raises red flags.
That the developer is not aware that their diagnostic raises a red flag itself raises a red flag. It doesn't occur to them that a system which issues this diagnostic will be suspected of doing stupid things. That tends to betray a lack of sophistication in the area of security.