News for hackers. Stuff that matters.

A comment on Password may not contain: select, insert, update, delete, drop.

Re:Password may not contain: select, insert, update, delete,... by chasil on Sunday January 21, 2024 @09:10AM (#39078547)
Did someone have a Bobby Tables moment?

https://bobby-tables.com/

In Oracle, you can't use a bind variable in setting a password on an account, so SQL injection is a more significant risk. I wrote some JavaScript and pl/sql to address that.

[ Parent | on HN ]
Re:Password may not contain: select, insert, update, delete,... by javitury on Sunday January 21, 2024 @09:15AM (#39078591)
I hope that javascript filter runs on the server and not on the web browser...
[ Parent | on HN ]
Re:Password may not contain: select, insert, update, delete,... by chasil on Sunday January 21, 2024 @09:31AM (#39078736)
The php runs on the server, and does the same thing.

The JavaScript posts excessive status messages, and only allows a submit when all checks have passed.

[ Parent | on HN ]
Re:Password may not contain: select, insert, update, delete,... by Falmarri on Sunday January 21, 2024 @01:57PM (#39081599)
Do you mean setting a database user account? As in the oracle user? Why is that exposed over the web?
[ Parent | on HN ]
Re:Password may not contain: select, insert, update, delete,... by SoftTalker on Sunday January 21, 2024 @02:30PM (#39082025)
There is/was a school of thought that each user should have their own database account, and the application should connect to the database as that user. The advantage being you can use the database's built-in user and role management and privileges instead of having to invent your own. I have admittedly not seen this done much, but there is a certain appeal to it.
[ Parent | on HN ]
Re:Password may not contain: select, insert, update, delete,... by d0gsg0w00f on Sunday January 21, 2024 @06:40PM (#39084224)
I work for a company that is trying to bolt this functionality onto all the AWS database products. At least at the IAM role level.

As it stands now, no human can write to a DB in prod-- only service accounts.

[ Parent | on HN ]