1–10 of 58 posts
14 Years of SQL Injection and still the most dangerous vulnerability
mavitunasecurity.com
Also:
This is primarily because of the most obvious problem:
We are still using relational SQL databases.
Were we to use NoSQL database systems such as MongoDB
or CouchDB, none of these attacks would ever happen
Why it's so common is that you can easily connect components incorrectly, still have it "work" enough to do a demo, and, there is lot of pressure to put things that appear to work into production without auditing them.
Addendum: Shish2k observes this article claims NoSQL databases would somehow solve the problem, rather than seeing NoSQL as just a different kind of component with it's own escaping/validation needs. Classic -- someone writing on this very topic is blinded to the phenomenon he discusses; the article itself demonstrates why we have SQL injections.
TL;DR: "Because you aren't using our snazzy new product; try it today!" Also: This is primarily because of the most obvious problem: We are still using relational SQL databases. Were we to use NoSQL database systems such as MongoDB or CouchDB, none of these attacks would ever happen Yeah, and motorbikes are safer than cars because the third and fourth wheels never fall off...
:( We are not safe
This is not software engineering alone, by the way.
TL;DR: "Because you aren't using our snazzy new product; try it today!" Also: This is primarily because of the most obvious problem: We are still using relational SQL databases. Were we to use NoSQL database systems such as MongoDB or CouchDB, none of these attacks would ever happen Yeah, and motorbikes are safer than cars because the third and fourth wheels never fall off...
It's not that devs and DBAs don't care, it's that in many cases (not all) they aren't given the time to carefully test the system to see how it might be abused.
And also, many companies view security testing as an afterthought or an audit requirement. If they do not have to do it (time is money) they won't. And when they are forced to do it, they rush through it.
In some ways this is a philosophical fight between a group that wants to ship software and make a profit and a group that wants to design and test systems to make sure they are correct. Suits vs technologists.
TL;DR: "Because you aren't using our snazzy new product; try it today!" Also: This is primarily because of the most obvious problem: We are still using relational SQL databases. Were we to use NoSQL database systems such as MongoDB or CouchDB, none of these attacks would ever happen Yeah, and motorbikes are safer than cars because the third and fourth wheels never fall off...