U.S. Election Agency Breached by Hackers After November Vote

Re:U.S. Election Agency Breached by Hackers After November Vote by MiddleEndian on Saturday December 24, 2016 @10:06PM (#13252659)

It's been awhile since I used PHP but even if you're not using a framework I'm pretty sure you can just wrap your strings with mysql_escape_string or some similarly named function.

[ Parent | on HN ]

Re:U.S. Election Agency Breached by Hackers After November Vote by stormbrew on Saturday December 24, 2016 @10:57PM (#13252823)

It has also been a long time since I've used php, but when I did there were a few problems here.

One is that mysql (opposed to oracle or pgsql) is kind of unusual in allowing quotes indiscriminately for all column types, so in order to do this right you have to only do it for string type columns and prevent injection on different types some other way.

Another is that most of the APIs around the more sprintf-style quoting (eg: `query("SELECT * FROM table WHERE x = %", someStr);`) are tied into prepared statements, which carry their own problems that also differ per engine.

It's actually not as simple as you might think. On top of that, php used to have the whole automatic quoting thing that just made a hash out of things.

[ Parent | on HN ]

Re:U.S. Election Agency Breached by Hackers After November Vote by krapp on Sunday December 25, 2016 @09:42AM (#13254224)

>I'm pretty sure you can just wrap your strings with mysql_escape_string or some similarly named function

Prepared statements have been a thing in PHP for a long time, now. Concatenating strings into SQL queries is no longer ever the right answer.

[ Parent | on HN ]