full-disclosure - FW: Introducing a new generic approach to detecting SQL injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed Apr 20 21:14:15 2005
From: mohit.muthanna at gmail.com (Mohit Muthanna)
Subject: FW: Introducing a new generic approach to
	detecting SQL injection

> As you know, blocking SQL injection with filters on characters is painful and
> not always successful. I got thinking about it and thought of an approach

Painful? That's just an excuse for being lazy. (No offense intended.)

Not always successful? ... I don't get this, why not?

There are a number of tools and libraries that will quite easily and
robustly handle quoting / escaping issues for you. E.g., perl's DBI
module handles all your quoting issues by way of prepared statements.

All it takes is a little forethought and a lot less laziness.

Mohit.

--
Mohit Muthanna [mohit (at) muthanna (uhuh) com]
"There are 10 types of people. Those who understand binary, and those
who don't."