Beefy Boxes and Bandwidth Generously Provided by pair Networks
Your skill will accomplish
what the force of many cannot

(tye)Re: Web Security

by tye (Sage)
on Jul 12, 2002 at 17:49 UTC ( #181354=note: print w/replies, xml ) Need Help??

in reply to Re: •Web Security
in thread Web Security

What were you afraid it was going to do? Perhaps this?     $node= '"; delete from nodes; ...';
Go ahead and try it (with something less dangerous). It doesn't work for me as I can't put multiple statements in a single DBI prepare().

I'm not defending code like that, I'm just pointing out something that I've always been told was a horrid security risk ("They could do anything they wanted to your data!") that isn't as bad (AFAICT) as lots of people are making it out to be.

Sure, they could probably launch a denial of service attack by making your SELECT extremely complicated if they could guess some of the structure of your database. (:

        - tye (but my friends call me "Tye")

Replies are listed 'Best First'.
Re: (tye)Re: Web Security
by Chady (Priest) on Jul 13, 2002 at 09:54 UTC

    I in fact was afraid from this delete you're talking about.. and I am using a DBI prepare in the runSQL() sub, it broke when I added a double quote in the query, so I didn't try the delete and assumed it might pass.

    I later removed the \Ws from it all.

    Thanx for pointing this out.

    He who asks will be a fool for five minutes, but he who doesn't ask will remain a fool for life.

    Chady |

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://181354]
[SuicideJunkie]: LanX So, basically, you're saying that Trump and Trump were the only ones doing it wrong there.

How do I use this? | Other CB clients
Other Users?
Others romping around the Monastery: (9)
As of 2018-03-22 20:46 GMT
Find Nodes?
    Voting Booth?
    When I think of a mole I think of:

    Results (286 votes). Check out past polls.