Exploiting 'INSERT INTO' SQL Injections Ninja Style

Re:Exploiting 'INSERT INTO' SQL Injections Ninja Style by code_duck on Saturday October 29, 2011 @01:04AM (#3171173)

You find it strange that this is upvoted on 'Hacker News'? Hackers like tinkering and understanding why things work. I understand the principles behind these flaws and am not interested in the article because I'm hoping it will teach me how to avoid SQL injection. The article is actually not about that; instead it's illustrates how a skilled attacker may specific features of MySQL to exploit flawed code in a stealthy way.

As a sysadmin, this is interesting. I help out people who run WordPress sites, for instance. While I do my best, on a practical level not all of the code can be audited or rewritten.

As an SQL coder, this is interesting as he's cleverly crafting code in a language I've spent a fair amount of time playing with, and about which I would like to know more. It's interesting to see how someone might do SQL injection in the same way you might wonder how people pick padlocks, despite having no need to pick padlocks yourself.

[ Parent | on HN ]

Re:Exploiting 'INSERT INTO' SQL Injections Ninja Style by gipsies on Saturday October 29, 2011 @06:50PM (#3173056)

Exactly! We all know SQL injections can be a common mistake. And the example php code is just that: An example. My focus wasn't the php code, or how to avoid this exploit, most of us already know that. But like you said the point is the interesting usage of SQL in this particular situation.

Glad you liked the post =)

[ Parent | on HN ]