News for hackers. Stuff that matters.

A comment on SQL "development" gone horribly wrong... .

Re:SQL "development" gone horribly wrong... by sabat on Monday July 07, 2008 @03:48PM (#239104)
- all web input needs to run thru the same filter - that filter disallows SQL keywords - you're done

If this guy wasn't on a shared host, he could just install mod_security and its default config should take care of it. Presuming Apache of course.

[ Parent | on HN ]
Re:SQL "development" gone horribly wrong... by LogicHoleFlaw on Monday July 07, 2008 @05:30PM (#239205)
I think ANDrew, TOny, SETh, and BYron might have problems with that filter.
[ Parent | on HN ]
Re:SQL "development" gone horribly wrong... by sabat on Tuesday July 08, 2008 @11:46AM (#239955)
They might if the programmer didn't have the sense to surround the keywords with word boundary markers. You know, something like %20SET%20 etc. I do this successfully with mod_security, and a good regex kit will let you do this easily.
[ Parent | on HN ]