Beefy Boxes and Bandwidth Generously Provided by pair Networks
Clear questions and runnable code
get the best and fastest answer
 
PerlMonks  

Re: •Web Security

by Chady (Priest)
on Jun 22, 2002 at 18:22 UTC ( #176504=note: print w/ replies, xml ) Need Help??


in reply to Web Security

Well, some people do really get clueless sometimes; I was delighted when I first implemented a search box on my site, it wasn't until very recently that I discovered a huge flaw in it. Here's what I've been using as code:

my $node = param('node'); if ($node) { my $ref = chady::db::runSQL("SELECT * FROM nodes WHERE title REGEXP \" +$node\" OR contents REGEXP \"$node\" "); ... ..

This was a case of production code that went published without review... the more scarry is that some people test and review, are aware of what they are doing, and still do it.


He who asks will be a fool for five minutes, but he who doesn't ask will remain a fool for life.

Chady | http://chady.net/


Comment on Re: •Web Security
Download Code
(tye)Re: Web Security
by tye (Cardinal) on Jul 12, 2002 at 17:49 UTC

    What were you afraid it was going to do? Perhaps this?     $node= '"; delete from nodes; ...';
    Go ahead and try it (with something less dangerous). It doesn't work for me as I can't put multiple statements in a single DBI prepare().

    I'm not defending code like that, I'm just pointing out something that I've always been told was a horrid security risk ("They could do anything they wanted to your data!") that isn't as bad (AFAICT) as lots of people are making it out to be.

    Sure, they could probably launch a denial of service attack by making your SELECT extremely complicated if they could guess some of the structure of your database. (:

            - tye (but my friends call me "Tye")

      I in fact was afraid from this delete you're talking about.. and I am using a DBI prepare in the runSQL() sub, it broke when I added a double quote in the query, so I didn't try the delete and assumed it might pass.

      I later removed the \Ws from it all.

      Thanx for pointing this out.


      He who asks will be a fool for five minutes, but he who doesn't ask will remain a fool for life.

      Chady | http://chady.net/

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://176504]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others avoiding work at the Monastery: (6)
As of 2014-12-25 18:20 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    Is guessing a good strategy for surviving in the IT business?





    Results (161 votes), past polls