full-disclosure - Question: is this exploitable?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: pdt at jackhammer.org (Paul Tinsley)
Subject: Question: is this exploitable?

I don't believe this is a true statement.

Perldoc on the quote function:
      "quote"
             $sql = $dbh->quote($value);
             $sql = $dbh->quote($value, $data_type);

           Quote a string literal for use as a literal value in an SQL 
state-
           ment, by escaping any special characters (such as quotation 
marks)
           contained within the string and adding the required type of outer
           quotation marks.

Perldoc on "Placeholders and Bind Values" or "execute" or "do" doesn't 
actually say anything about escaping special characters, but it does do 
it.  So in my opinion, for those who don't magically know that prepare 
with placeholders will take care of the problem quote is the natural 
choice...

Looking at the code shows that using the quote routine or placeholders 
end up being quoted exactly the same way.  Quote does it directly, with 
placeholders making it down the path via: 
[execute|do]->mysql_st_internal_execute->ParseParam->mysql_real_escape_string.

Function called from either path (excerpt from mysql.h):
unsigned long STDCALL mysql_real_escape_string(MYSQL *mysql,
                                               char *to,const char *from,
                                               unsigned long length);

I personally prefer the placeholder method myself, but quote does the job.

---------
Paul Tinsley

"There's More Than One Way To Do It"
  -- Larry Wall

Jonathan A. Zdziarski wrote:

>Eh? How does this prevent a sql injection exploit?  Placeholders (as was
>previously suggested) are really the only way to accomplish that.
>
>  
>
>>$query=sprintf("insert into projects values(null,%s)",dbh->quote($project));
>>$sth = $dbh->prepare($query);
>>    
>>
>
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html
>  
>