lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
From: pdt at jackhammer.org (Paul Tinsley) Subject: Question: is this exploitable? I don't believe this is a true statement. Perldoc on the quote function: "quote" $sql = $dbh->quote($value); $sql = $dbh->quote($value, $data_type); Quote a string literal for use as a literal value in an SQL state- ment, by escaping any special characters (such as quotation marks) contained within the string and adding the required type of outer quotation marks. Perldoc on "Placeholders and Bind Values" or "execute" or "do" doesn't actually say anything about escaping special characters, but it does do it. So in my opinion, for those who don't magically know that prepare with placeholders will take care of the problem quote is the natural choice... Looking at the code shows that using the quote routine or placeholders end up being quoted exactly the same way. Quote does it directly, with placeholders making it down the path via: [execute|do]->mysql_st_internal_execute->ParseParam->mysql_real_escape_string. Function called from either path (excerpt from mysql.h): unsigned long STDCALL mysql_real_escape_string(MYSQL *mysql, char *to,const char *from, unsigned long length); I personally prefer the placeholder method myself, but quote does the job. --------- Paul Tinsley "There's More Than One Way To Do It" -- Larry Wall Jonathan A. Zdziarski wrote: >Eh? How does this prevent a sql injection exploit? Placeholders (as was >previously suggested) are really the only way to accomplish that. > > > >>$query=sprintf("insert into projects values(null,%s)",dbh->quote($project)); >>$sth = $dbh->prepare($query); >> >> > > >_______________________________________________ >Full-Disclosure - We believe in it. >Charter: http://lists.netsys.com/full-disclosure-charter.html > >
Powered by blists - more mailing lists