Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on Slack was hacked. Parent comment
1. Not all SQL statements are parameterizable (dynamic identifiers vs literals)
2. Stopping SQL injection doesn't stop Insecure Direct Object References
3. Developers make mistakes
4. Plugins are a risk (example: http://www.zdnet.com/article/over-1-million-wordpress-websit...)
For parameterization to work you need to be perfect, always. My suggestions are for when someone else fucks up.
There are no comments on this comment yet.
1. Not all SQL statements are parameterizable (dynamic identifiers vs literals)
2. Stopping SQL injection doesn't stop Insecure Direct Object References
3. Developers make mistakes
4. Plugins are a risk (example: http://www.zdnet.com/article/over-1-million-wordpress-websit...)
For parameterization to work you need to be perfect, always. My suggestions are for when someone else fucks up.