News for hackers. Stuff that matters.

A comment on Slack was hacked. Parent comment

Re:Slack was hacked by _trb_ on Friday March 27, 2015 @06:37PM (#9279503)
The most important thing to stop sql injection is to validate your parameters on the server side.
[ Parent | on HN ]
Re:Slack was hacked by elchief on Friday March 27, 2015 @07:03PM (#9279626)
Yes, but:

1. Not all SQL statements are parameterizable (dynamic identifiers vs literals)

2. Stopping SQL injection doesn't stop Insecure Direct Object References

3. Developers make mistakes

4. Plugins are a risk (example: http://www.zdnet.com/article/over-1-million-wordpress-websit...)

For parameterization to work you need to be perfect, always. My suggestions are for when someone else fucks up.

[ Parent | on HN ]