News for hackers. Stuff that matters.

A comment on Finding an authorization bypass on my own website. Parent comment

Re:Finding an authorization bypass on my own website by bgrainger on Saturday March 05, 2022 @10:19PM (#30574721)
One major problem is that the MySQL "text" protocol doesn't support true parameterised queries. There's no way to pass parameters in the `COM_QUERY` packet: https://dev.mysql.com/doc/internals/en/com-query.html

That's probably why many of the libraries mentioned in this thread use "smoke and mirrors". Of course, it is quite possible to correctly escape a value by rendering it to a string first, _then_ encoding the whole thing.

To have true parameterised queries, you need to use the "binary" protocol, which many MySQL libraries don't offer support for. (MySQL also has some frustrating limitations with the binary protocol, such as not allowing a SQL string containing more than one statement to be prepared.)

[ Parent | on HN ]
Re:Finding an authorization bypass on my own website by namibj on Saturday March 05, 2022 @10:46PM (#30574858)
PostgreSQL shares that limitation on it's extended query protocol (needed for prepared statements), though you can send multiple queries off before sending the "I'm waiting, hurry up and get back with answers" packet to the server. Not that the native C library (libpq) supports such pipelining...
[ Parent | on HN ]