No-SQL injection in Mongo PHP

Re:No-SQL injection in Mongo PHP by ronnoch on Monday March 07, 2011 @02:49PM (#2298398)

Somehow I managed to use PHP for 8 years and never notice this... Time to double check all my input sanitizing code, I guess.

[ Parent | on HN ]

Re:No-SQL injection in Mongo PHP by jasonlotito on Monday March 07, 2011 @04:28PM (#2298770)

8 years and you didn't know this? I assume it's the part where it turns [] passed vars into arrays. Even still, this is only a problem is you are blindly passing around user input without any verification. The same thing is just as easily accomplished in numerous other languages.

Honestly, I'm trying to figure out how someone could sanitize their input and still be affected by this.

[ Parent | on HN ]

Re:No-SQL injection in Mongo PHP by ronnoch on Monday March 07, 2011 @05:02PM (#2298898)

> Honestly, I'm trying to figure out how someone could sanitize their input and still be affected by this.

I don't think you could, unless you tried to write your own sanitizing functions from scratch and somehow screwed it up. In PHP, htmlspecialchars(), mysql_real_escape_string() and addslashes() all do fine sanitizing array input -- either throwing an exception or returning the string "Array".

[ Parent | on HN ]

Re:No-SQL injection in Mongo PHP by Getahobby on Monday March 07, 2011 @08:58PM (#2299519)

Hmm. I think these functions escape output, not sanitize input.

[ Parent | on HN ]