Re:Finding an authorization bypass on my own website
by hn_throwaway_99 on Saturday March 05, 2022 @07:54PM
(#30573798)
Well, in this case mysqljs pretty well fucked up the implementation here in that this sort of bug should never happen when using prepared statements, so I'd say it's worse than not having it at all, because it breaks the standard safety guarantees of prepared statements.
[ Parent
| on HN ]
Re:Finding an authorization bypass on my own website
by Aeolun on Saturday March 05, 2022 @11:46PM
(#30575101)
This implies that the alternative to using mysqljs is using prepared statements, which is most definitely not the case.
The alternative for people using a library like this is to send plain queries to the db.