Beefy Boxes and Bandwidth Generously Provided by pair Networks
go ahead... be a heretic

Re: Yet another reason to use DBI placeholders

by diotalevi (Canon)
on Dec 14, 2008 at 06:25 UTC ( #730257=note: print w/replies, xml ) Need Help??

in reply to Yet another reason to use DBI placeholders

Hey, funny that. There's a SQL injection ( in the latest DBD::Pg that works even in the face of placeholders.

> > $s=$d->prepare(q[select ? where 1=?], { pg_server_prepare => 0 }); > > $s->bind_param(2,undef,SQL_INTEGER); > > $s->execute(1,"2; drop table x;");

⠤⠤ ⠙⠊⠕⠞⠁⠇⠑⠧⠊

Replies are listed 'Best First'.
Re^2: Yet another reason to use DBI placeholders
by mr_mischief (Monsignor) on Dec 16, 2008 at 03:10 UTC
    That's a scary one. Here's hoping it's fixed soon. I also hope that if the bind_param call is not made that "2; drop table x;" would be passed as a quoted string in the meantime.

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://730257]
Discipulus 3 earthquake between 5.1 and 5.3.. Closed the subway in roma and many schools evacuated: the school of my little daugther was evacuated.. but nobody called us..

How do I use this? | Other CB clients
Other Users?
Others drinking their drinks and smoking their pipes about the Monastery: (5)
As of 2017-01-18 11:39 GMT
Find Nodes?
    Voting Booth?
    Do you watch meteor showers?

    Results (161 votes). Check out past polls.