bugtraq - Re: Intresting case of SQL Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 5 Dec 2003 22:18:30 +0100
From: Florian Weimer <fw@...eb.enyo.de>
To: "Scovetta, Michael V" <Michael.Scovetta@...com>
Cc: "Martin Sarsale (runa@...es)" <runa@...a.sytes.net>,
	bugtraq@...urityfocus.com
Subject: Re: Intresting case of SQL Injection

Scovetta, Michael V wrote:

>   I've run into this, and my solution for MSSQL was to use Java
> PreparedStatements). 

Unfortunately, there appears to be a misconception surrounding Java
prepared statements.  Many developers assume that the only reason to use
them is performance, and are extremely reluctant to switching (even if
the application architecture would allow for that with a reasonable
delevelopment effort).

I believe that the relative fragility of database gateways written in
PHP is a result of the late availability of higher-level database
interface libraries (comparable to JDBC or Perl's DBI) and thus the
large amount of hand-written SQL statement generation code.