Re:Exploiting 'INSERT INTO' SQL Injections Ninja Style
by InclinedPlane on Friday October 28, 2011 @06:08PM
(#3170306)
P.S. It's 2011, if you are concatenating strings IN ANY LANGUAGE to build up SQL statements and you aren't even bothering to sanitize input then:
1: You cannot call yourself a professional web developer. You can't even call yourself a competent amateur programmer, you are just playing with toys you clearly do not understand.
2: You deserve absolutely no pity when (not if) you get hacked.
If this sounds harsh, it's meant to, this is an incredibly well known problem (and has been for years) and it's incredibly easy to fix.
1: You cannot call yourself a professional web developer. You can't even call yourself a competent amateur programmer, you are just playing with toys you clearly do not understand.
2: You deserve absolutely no pity when (not if) you get hacked.
If this sounds harsh, it's meant to, this is an incredibly well known problem (and has been for years) and it's incredibly easy to fix.