MOVEit body count closes in on 400 orgs, 20M+ individuals

Re:MOVEit body count closes in on 400 orgs, 20M+ individuals by silon42 on Sunday July 23, 2023 @03:34PM (#36838884)

Huh, no?

Tt's very easy to do it incorrectly.

It's at best equal... unless there is some SQL driver/client somewhere that disallows hardcoded strings everywhere (that would actually really help).

[ Parent | on HN ]

Re:MOVEit body count closes in on 400 orgs, 20M+ individuals by throwaway894345 on Wednesday July 26, 2023 @05:25PM (#36885278)

Don't pass interpolated strings to the SQL driver? It seems super easy to do `exec("select * from table where column1=?")` instead of `exec(sprintf("select * from table where column1='%s'", user_data))`. If someone is doing the latter and they're super junior, it's a teachable moment. If they're not super junior I'm wondering what else they're sloppy about and if they need handholding (or worse).

[ Parent | on HN ]