Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SQL injection search

github.com

Post reply on HN
Print view View original

11–20 of 114 posts

Re: SQL injection search

#13

Post by PanMan »

Nice example, but not all are insecure. For example, the second one here is:

    $result = mysql_query('DELETE FROM saves WHERE id = '.(int)$_GET['delete']);

Re: SQL injection search

#16

Post by martinml »

PanMan wrote: post #13

Nice example, but not all are insecure. For example, the second one here is: $result = mysql_query('DELETE FROM saves WHERE id = '.(int)$_GET['delete']);

It still doesn't check if a particular id belongs to the user, so you can delete all the items in the table. But I agree that's different kind of problem :)

Re: SQL injection search

#17

Post by kbenson »

PanMan wrote: post #13

Nice example, but not all are insecure. For example, the second one here is: $result = mysql_query('DELETE FROM saves WHERE id = '.(int)$_GET['delete']);

The search obviously doesn't find all cases, but is a good start.

While there's nothing technically wrong with the example given, I might argue that since that won't work in all cases, it might be better to enforce a more rigorous policy of SQL query cleansing, or using bound params. Although this example is so simple I might not.

Then again, the fact that $_GET is even available at the location the query is taking place means this is most likely a type of design that I abhor, that PHP makes easy. Put actions in functions or methods, and then call them.

Re: SQL injection search

#18

Post by rlt3 »

soult wrote: post #14
Killswitch wrote: post #8

Using unsanitized $_GET is the least of their problems considering mysql_* is deprecated.

So a gaping security hole that compromises all data is less important than using a deprecated interface?

He said it was the least of their problems, not that it was the least important.

Re: SQL injection search

#19

Post by hising »

I guess people would pay for a service that could identify 90% of all security issues with an online service by going through source code and available routes. Anything that is available today?
Post reply on HN