Re:MOVEit body count closes in on 400 orgs, 20M+ individuals
by dontlaugh on Sunday July 23, 2023 @11:43AM
(#36836397)
In most environments, itβs more effort to interpolate values into queries than to use parameters.
Re:MOVEit body count closes in on 400 orgs, 20M+ individuals
by magicalhippo on Sunday July 23, 2023 @11:57AM
(#36836532)
Not only more effort, but also the only way in certain cases as not everything supports parameterization. The IN operator for example is one where we fall back to string interpolation, though not directly with user values.
Re:MOVEit body count closes in on 400 orgs, 20M+ individuals
by silon42 on Sunday July 23, 2023 @03:34PM
(#36838884)
Huh, no?
Tt's very easy to do it incorrectly.
It's at best equal... unless there is some SQL driver/client somewhere that disallows hardcoded strings everywhere (that would actually really help).
Re:MOVEit body count closes in on 400 orgs, 20M+ individuals
by throwaway894345 on Wednesday July 26, 2023 @05:25PM
(#36885278)
Don't pass interpolated strings to the SQL driver? It seems super easy to do `exec("select * from table where column1=?")` instead of `exec(sprintf("select * from table where column1='%s'", user_data))`. If someone is doing the latter and they're super junior, it's a teachable moment. If they're not super junior I'm wondering what else they're sloppy about and if they need handholding (or worse).
Because the bug is super trivial to fix, it's also super trivial to do. Not to mention, the human mind is naturally inclined to not care about trivial stuff, which leads to careless mistakes at many levels and thus Bobby Tables dropped out of school.