Beefy Boxes and Bandwidth Generously Provided by pair Networks
Problems? Is your data what you think it is?
 
PerlMonks  

Re: Yet another reason to use DBI placeholders

by diotalevi (Canon)
on Dec 14, 2008 at 06:25 UTC ( #730257=note: print w/replies, xml ) Need Help??


in reply to Yet another reason to use DBI placeholders

Hey, funny that. There's a SQL injection (https://rt.cpan.org/Ticket/Display.html?id=41565 in the latest DBD::Pg that works even in the face of placeholders.

> > $s=$d->prepare(q[select ? where 1=?], { pg_server_prepare => 0 }); > > $s->bind_param(2,undef,SQL_INTEGER); > > $s->execute(1,"2; drop table x;");

⠤⠤ ⠙⠊⠕⠞⠁⠇⠑⠧⠊

Replies are listed 'Best First'.
Re^2: Yet another reason to use DBI placeholders
by mr_mischief (Monsignor) on Dec 16, 2008 at 03:10 UTC
    That's a scary one. Here's hoping it's fixed soon. I also hope that if the bind_param call is not made that "2; drop table x;" would be passed as a quoted string in the meantime.

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://730257]
help
Chatterbox?
[Sinistral]: stonecolddevin / stevieb - would 'he' in this context (looked at last 50 lines and didn't see discussion) be a certain solar timepiece user?
[stonecolddevin]: Sinistral yes indeed
[Discipulus]: he does not learn, nor teach, nor learn
[planetscape]: hello all
[stonecolddevin]: o/ planetscape
[Sinistral]: I think that just the sight of his username now causes a downvote storm. I agree, and the gratuitous use of formatting does make reading hard. I've given him +1 on things where there seemed to be actual good advice, but I think the big
[Sinistral]: nail in coffin was the rant against a Schwarzian Transform
[stonecolddevin]: at best, from what i've seen, his knowledge is accurate up to maybe 2002. the sheer volume of words is mostly worthy of a downvote in most cases though i think
[erix]: ITYM Schwartzian Transform :P
[erix]: hey planetscape :)

How do I use this? | Other CB clients
Other Users?
Others browsing the Monastery: (10)
As of 2017-06-22 20:54 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    How many monitors do you use while coding?















    Results (530 votes). Check out past polls.