Beefy Boxes and Bandwidth Generously Provided by pair Networks
"be consistent"
 
PerlMonks  

(tye)Re: Web Security

by tye (Cardinal)
on Jul 12, 2002 at 17:49 UTC ( #181354=note: print w/ replies, xml ) Need Help??


in reply to Re: •Web Security
in thread Web Security

What were you afraid it was going to do? Perhaps this?     $node= '"; delete from nodes; ...';
Go ahead and try it (with something less dangerous). It doesn't work for me as I can't put multiple statements in a single DBI prepare().

I'm not defending code like that, I'm just pointing out something that I've always been told was a horrid security risk ("They could do anything they wanted to your data!") that isn't as bad (AFAICT) as lots of people are making it out to be.

Sure, they could probably launch a denial of service attack by making your SELECT extremely complicated if they could guess some of the structure of your database. (:

        - tye (but my friends call me "Tye")


Comment on (tye)Re: Web Security
Download Code
Re: (tye)Re: Web Security
by Chady (Priest) on Jul 13, 2002 at 09:54 UTC

    I in fact was afraid from this delete you're talking about.. and I am using a DBI prepare in the runSQL() sub, it broke when I added a double quote in the query, so I didn't try the delete and assumed it might pass.

    I later removed the \Ws from it all.

    Thanx for pointing this out.


    He who asks will be a fool for five minutes, but he who doesn't ask will remain a fool for life.

    Chady | http://chady.net/

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://181354]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others wandering the Monastery: (11)
As of 2014-09-19 09:04 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    How do you remember the number of days in each month?











    Results (133 votes), past polls