How I bypassed Cloudflare's SQL Injection filter

Re:How I bypassed Cloudflare's SQL Injection filter by colejohnson66 on Friday September 18, 2020 @06:11PM (#24522377)

Isn’t the correct solution to replace '<' and '>' with '<' and '>'?

[ Parent | on HN ]

Re:How I bypassed Cloudflare's SQL Injection filter by yyyk on Saturday September 19, 2020 @02:45PM (#24529594)

The correct solution is to apply Content-Security-Policy plus character escaping as needed.

[ Parent | on HN ]

Re:How I bypassed Cloudflare's SQL Injection filter by krapp on Friday September 18, 2020 @06:14PM (#24522397)

Yeah, escaping entities when rendering, using prepared statements in the database. It's not rocket science.

[ Parent | on HN ]

Re:How I bypassed Cloudflare's SQL Injection filter by tannhaeuser on Saturday September 19, 2020 @02:33AM (#24525623)

Or, you know, using ordinary SGML validation which has the capability to block disallowed elements since 1986.

[ Parent | on HN ]

Re:How I bypassed Cloudflare's SQL Injection filter by gskourou on Friday September 18, 2020 @06:25PM (#24522458)

amen

[ Parent | on HN ]