[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20031204223758.GA5767@gjat.josefine.at>
Date: Thu, 4 Dec 2003 23:37:58 +0100
From: Markus Fischer <mfischer@...t.josefine.at>
To: "Martin Sarsale (runa@...es)" <runa@...a.sytes.net>
Cc: bugtraq@...urityfocus.com
Subject: Re: Intresting case of SQL Injection
On Thu, Dec 04, 2003 at 04:39:15PM -0300, Martin Sarsale (runa@...es) wrote :
> Yesterday, we found an interesting case of SQL Injection.
[...]
> The main problem here was that developers where trusting in PHP auto
> escaping which worked in MySQL (and probably PostgreSQL) but not in MSSQL.
The main problem in fact are developers who do not read the manual
for their language of choice[tm]. It is documented that
magic_quotes_sybase = true
uses the alternate escaping style needed by non-MySQL alike
databases (eg. MSSQL).
regards,
- Markus
Powered by blists - more mailing lists