Re:SQL Injection Vulnerability in Rails
by tptacek on Friday June 01, 2012 @11:46AM
(#4054041)
You're (respectfully) not terribly familiar with Rails, then, because the interpretation of foo[bar]=xxx as { :foo => { :bar => 'xxx' } } is one of the core patterns in the framework. Code all across the platform depends on that behavior.
[ Parent
| on HN ]
This is the same with PHP. Be aware anyone using something like MongoDB, if you don't sanitize/cast your inputs, your app could be vulnerable.
e.g. if you have the code:
$collection->findOne( array( 'username' => $_POST['username'], 'password' => $_POST['password'] ) );