No-SQL injection in Mongo PHP

Re:No-SQL injection in Mongo PHP by rbanffy on Monday March 07, 2011 @08:19PM (#2299438)

The problem is that under the hood there is a query language. When you have no query language, you can't inject commands into it, either by carelessly passing user input down the stack or assembling your own queries.

It would be devilishly hard to inject malicious operations into ZEO/ZODB (the one "NoSQL" I am very familiar with). I can only assume it would be equally hard to do it with systems that do not try to replicate the human-friendly nature of SQL.

[ Parent | on HN ]

Re:No-SQL injection in Mongo PHP by tptacek on Monday March 07, 2011 @08:39PM (#2299471)

See my original comment.

[ Parent | on HN ]

Re:No-SQL injection in Mongo PHP by rbanffy on Monday March 07, 2011 @08:59PM (#2299522)

My comment has no relation to escaping. It's in fact, centered on the idea that any attempt to do so will introduce potential vulnerabilities and the only sane way out of this mess is not having a language in the first place.

Anyway, the idea of blindingly assuming that just because something doesn't use SQL it's invulnerable to any kind of code injection is a very optimistic position.

[ Parent | on HN ]

Re:No-SQL injection in Mongo PHP by tptacek on Monday March 07, 2011 @09:50PM (#2299614)

Thank you for restating my comment. Perhaps your wording will be clearer than mine.

[ Parent | on HN ]

Re:No-SQL injection in Mongo PHP by rbanffy on Tuesday March 08, 2011 @07:47AM (#2300677)

Anyway, NoSQL databases are, by definition, invulnerable to SQL-injection attacks. Perhaps we should start calling them "command injection" or something like it.

[ Parent | on HN ]