How I bypassed Cloudflare's SQL Injection filter

Re:How I bypassed Cloudflare's SQL Injection filter by nucleardog on Saturday September 19, 2020 @03:28AM (#24525827)

Until you run across code that's doing something like:

    def search(key, value):
        query("select * from my_table where `" + key + "` = '" + value + "'")

Not that I'm suggesting this is a good thing to do, but it's not something you can simply replace with a single line of context or easily.

[ Parent | on HN ]

Re:How I bypassed Cloudflare's SQL Injection filter by nicoburns on Saturday September 19, 2020 @07:11AM (#24526612)

I believe you could handle that case with an escaping function for the `key` variable. Column names are generally quite restricted in what characters they can contain, so this is fairly easy to do in a water-tight way. Of course this won't restrict which column you're giving access to, but a WAF won't catch that either.

[ Parent | on HN ]