News for hackers. Stuff that matters.

A comment on No-SQL injection in Mongo PHP. Parent comment

Re:No-SQL injection in Mongo PHP by bmm6o on Wednesday March 09, 2011 @12:31PM (#2305593)
In theory, it should be possible to enumerate your SQL queries ahead of time rather than ever generating one on the fly. In practice, that could be a huge pain of the O(2^n) variety, depending on the application type.
[ Parent | on HN ]
Re:No-SQL injection in Mongo PHP by rbanffy on Wednesday March 09, 2011 @01:23PM (#2305802)
I assume the choice of table names or query templates in the case mentioned (make a report for atypical client C run faster) would be limited to a handful of possible query templates.
[ Parent | on HN ]