14 Years of SQL Injection and still the most dangerous vulnerability

Re:14 Years of SQL Injection and still the most dangerous vu... by Shish2k on Thursday August 22, 2013 @08:22AM (#6256637)

TL;DR: "Because you aren't using our snazzy new product; try it today!"

Also:

    This is primarily because of the most obvious problem:
    We are still using relational SQL databases.
    Were we to use NoSQL database systems such as MongoDB
    or CouchDB, none of these attacks would ever happen

Yeah, and motorbikes are safer than cars because the third and fourth wheels never fall off...

[ Parent | on HN ]

Re:14 Years of SQL Injection and still the most dangerous vu... by ponyous on Thursday August 22, 2013 @09:08AM (#6256840)

+ even this is not entirely true. In PHP you can inject into Mongo using nested arrays.

:( We are not safe

[ Parent | on HN ]

Re:14 Years of SQL Injection and still the most dangerous vu... by troels on Thursday August 22, 2013 @09:22AM (#6256933)

It doesn't even make sense. The problem is in the client side drivers/apis. That has absolutely nothing todo with the underlying storage system.

[ Parent | on HN ]

Re:14 Years of SQL Injection and still the most dangerous vu... by SigmundA on Thursday August 22, 2013 @10:28AM (#6257344)

Make perfect sense, since there is no SQL in NoSQL its impossible to have a SQL injection, problem solved...

[ Parent | on HN ]

Re:14 Years of SQL Injection and still the most dangerous vu... by astrodust on Thursday August 22, 2013 @12:30PM (#6258154)

In MongoDB you could theoretically have a JavaScript injection, which I'd argue is pretty bad.

[ Parent | on HN ]

Re:14 Years of SQL Injection and still the most dangerous vu... by SigmundA on Thursday August 22, 2013 @01:34PM (#6258581)

Sorry the sarcasm didn't transfer to my post, you are correct.

[ Parent | on HN ]

Re:14 Years of SQL Injection and still the most dangerous vu... by lucian1900 on Thursday August 22, 2013 @09:57AM (#6257142)

Especially since MongoDB is not too hard to inject, in particular its aggregation framework.

[ Parent | on HN ]