Re: •Web Security

[Chady]

in reply to Web Security

Well, some people do really get clueless sometimes; I was delighted when I first implemented a search box on my site, it wasn't until very recently that I discovered a huge flaw in it. Here's what I've been using as code:

my $node = param('node');

if ($node) {
my $ref = chady::db::runSQL("SELECT * FROM nodes WHERE title REGEXP \"
+$node\" OR contents REGEXP \"$node\" ");
...
..

This was a case of production code that went published without review... the more scarry is that some people test and review, are aware of what they are doing, and still do it.

---

He who asks will be a fool for five minutes, but he who doesn't ask will remain a fool for life.

Chady | http://chady.net/

[tye]

What were you afraid it was going to do? Perhaps this?     $node= '"; delete from nodes; ...';
Go ahead and try it (with something less dangerous). It doesn't work for me as I can't put multiple statements in a single DBI prepare().

I'm not defending code like that, I'm just pointing out something that I've always been told was a horrid security risk ("They could do anything they wanted to your data!") that isn't as bad (AFAICT) as lots of people are making it out to be.

Sure, they could probably launch a denial of service attack by making your SELECT extremely complicated if they could guess some of the structure of your database. (:

        - tye (but my friends call me "Tye")

[Chady]

I in fact was afraid from this delete you're talking about.. and I am using a DBI prepare in the runSQL() sub, it broke when I added a double quote in the query, so I didn't try the delete and assumed it might pass.

I later removed the \Ws from it all.

Thanx for pointing this out.

---

He who asks will be a fool for five minutes, but he who doesn't ask will remain a fool for life.

Chady | http://chady.net/