Re:How I bypassed Cloudflare's SQL Injection filter
by BitwiseFool on Friday September 18, 2020 @07:12PM
(#24522758)
I guess Marketing learned a valuable lesson about SQL keywords. It's also amusing to me because you know some engineer at Amazon must have brought up an edge case where a valid request would start with SELECT - but they were probably dismissed because how often would that happen - really?
[ Parent
| on HN ]
Re:How I bypassed Cloudflare's SQL Injection filter
by divbzero on Friday September 18, 2020 @07:18PM
(#24522806)
Also amusing is the thought that lowercase "select" is any safer than uppercase "SELECT".
Re:How I bypassed Cloudflare's SQL Injection filter
by userbinator on Friday September 18, 2020 @10:17PM
(#24524294)
I can't believe anyone who has ever actually used SQL for more than a few hours would not know the keywords are case-insensitive. More likely it was just someone given a list of keywords to filter out, with no mention of case-(in)sensitivity.
Re:How I bypassed Cloudflare's SQL Injection filter
by dylan604 on Friday September 18, 2020 @10:31PM
(#24524382)
is case sensitivity training available through HR we can send the new recruits?
Re:How I bypassed Cloudflare's SQL Injection filter
by blackflame7000 on Friday September 18, 2020 @11:39PM
(#24524776)
On a case by case basis
Re:How I bypassed Cloudflare's SQL Injection filter
by wiredone on Friday September 18, 2020 @09:34PM
(#24524019)
More likely an SDE-1 at Amazon 3 months out of college was given a sprint task and because they’ve only ever worked on nosql they had no idea about the edge cases of what they were asked to do.