LIKE injection
githubengineering.com
LIKE injection
1–5 of 5 posts
Re: LIKE injection
#2Perhaps Github isn't on Rails 4.2, but they've already created a method for sanitizing SQL like statements in ActiveRecord::Sanitization[1], so they shouldn't need a custom function to remove SQL injection. Also, you could always just use ActiveRecord::Base.connection.quote which will safely quote the string you want to input.
[1] http://apidock.com/rails/ActiveRecord/Sanitization/ClassMeth...
Re: LIKE injection
#3The LIKE query '%64%68%6f%6d%65%73@%67%6d%61%69%6c.%63%6f%6d%' wasn't an injection attempt, it's just a URL-encoded email address. Most likely it was accidentally double-encoded in the search URL for some reason, so it ended up still encoded in the SQL query.
Re: LIKE injection
#4Perhaps Github isn't on Rails 4.2, but they've already created a method for sanitizing SQL like statements in ActiveRecord::Sanitization[1], so they shouldn't need a custom function to remove SQL injection. Also, you could always just use ActiveRecord::Base.connection.quote which will safely quote the string you want to input. [1] http://apidock.com/rails/ActiveRecord/Sanitization/ClassMeth...
ActiveRecord::Base.connection.quote doesn't escape % or any other LIKE-special character.
Re: LIKE injection
#5I actually had this issue in a chat room bot where people would do exactly this to attempt (and in some cases succeed) in a DoS against the database