Finding an authorization bypass on my own website

Re:Finding an authorization bypass on my own website by namibj on Saturday March 05, 2022 @10:53PM (#30574890)

You can combine literals into an SQL query, and doing so isn't even hard to do correctly. You'd still use parameters to feed user input, of course.

[ Parent | on HN ]

Re:Finding an authorization bypass on my own website by DaiPlusPlus on Sunday March 06, 2022 @12:52AM (#30575352)

SQL Server has had _autoparameterization_ opf queries for a while now: when you have multiple queries of the same general shape but with varying literal values, it automatically converts the literals to parameters (rather than vice-versa), and it's generally beneficial for performance because existing query-plans can be reused (instead of having to create a new plan for each literal value encountered): https://www.mssqltips.com/sqlservertip/2935/sql-server-simpl...

[ Parent | on HN ]

Re:Finding an authorization bypass on my own website by namibj on Sunday March 06, 2022 @02:54AM (#30575825)

I didn't mean it that way. I mean you can combine SQL fragments, think multiple `ORDER BY` clauses.

[ Parent | on HN ]