Beefy Boxes and Bandwidth Generously Provided by pair Networks
Perl: the Markov chain saw
 
PerlMonks  

Re^4: Simple question on SQL Injection

by naikonta (Curate)
on Oct 10, 2007 at 19:03 UTC ( #644066=note: print w/ replies, xml ) Need Help??


in reply to Re^3: Simple question on SQL Injection
in thread Simple question on SQL Injection

A quick peek within the source revealed that it does quote table names and other values that you can't use placeholders for.
SQL::Abstract does quote table names and field names with whatever $self->{quote_char} is set to, which is default to empty string. At least MySQL allows to quote table and field names with backtick characters (`table_name`).
use SQL::Abstract; my $SQL = SQL::Abstract->new(quote_char => '`');
Quoting tables and fields (selet * from `user`) is different from quoting values (where name = 'bob'). So what's the problem? You can't use placeholders on tables and fields, after all, only values. From DBI docs:
With most drivers, placeholders canít be used for any element of a statement that would prevent the database server from validating the statement and creating a query execution plan for it. For example:
"SELECT name, age FROM ?" # wrong (will probably fail) "SELECT name, ? FROM people" # wrong (but may not ífailí)

Open source softwares? Share and enjoy. Make profit from them if you can. Yet, share and enjoy!


Comment on Re^4: Simple question on SQL Injection
Select or Download Code
Re^5: Simple question on SQL Injection
by AK108 (Friar) on Oct 11, 2007 at 05:05 UTC
    I was unaware that SQL::Abstract did not quote table names. However, I am aware of the difference between placeholders and quoting (as I did a bit of pure DBI before using SQL::Abstract in conjunction with it). Your message does show the difference better than mine.

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://644066]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others having an uproarious good time at the Monastery: (6)
As of 2015-07-05 13:45 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    The top three priorities of my open tasks are (in descending order of likelihood to be worked on) ...









    Results (67 votes), past polls