Beefy Boxes and Bandwidth Generously Provided by pair Networks
There's more than one way to do things

(tye)Re: Web Security

by tye (Sage)
on Jul 12, 2002 at 17:49 UTC ( #181354=note: print w/ replies, xml ) Need Help??

in reply to Re: •Web Security
in thread Web Security

What were you afraid it was going to do? Perhaps this?     $node= '"; delete from nodes; ...';
Go ahead and try it (with something less dangerous). It doesn't work for me as I can't put multiple statements in a single DBI prepare().

I'm not defending code like that, I'm just pointing out something that I've always been told was a horrid security risk ("They could do anything they wanted to your data!") that isn't as bad (AFAICT) as lots of people are making it out to be.

Sure, they could probably launch a denial of service attack by making your SELECT extremely complicated if they could guess some of the structure of your database. (:

        - tye (but my friends call me "Tye")

Comment on (tye)Re: Web Security
Download Code
Replies are listed 'Best First'.
Re: (tye)Re: Web Security
by Chady (Priest) on Jul 13, 2002 at 09:54 UTC

    I in fact was afraid from this delete you're talking about.. and I am using a DBI prepare in the runSQL() sub, it broke when I added a double quote in the query, so I didn't try the delete and assumed it might pass.

    I later removed the \Ws from it all.

    Thanx for pointing this out.

    He who asks will be a fool for five minutes, but he who doesn't ask will remain a fool for life.

    Chady |

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://181354]
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others perusing the Monastery: (9)
As of 2015-11-28 02:30 GMT
Find Nodes?
    Voting Booth?

    What would be the most significant thing to happen if a rope (or wire) tied the Earth and the Moon together?

    Results (737 votes), past polls