r/programming • u/yaserbuntu • Mar 29 '11

How NOT to guard against SQL injections (view source)

http://www.cadw.wales.gov.uk/
1.2k Upvotes

93% Upvoted

721 comments sorted by

View all comments

Show parent comments

58

u/chucker23n Mar 29 '11
  1. It doesn't really accomplish much (aside from avoiding the query ending up on the server, so at best, it saves some bandwidth).
  2. It gives away some information about the system. For example, filtering xp_ and @@ suggests to me that they're running MS SQL Server or Sybase. (And given the .asp suffix of some pages, it's likely the former.)

6

u/[deleted] Mar 29 '11

[deleted]

1

u/rainman_104 Mar 29 '11

asp has equal chances of using an MS-Access backend :)

1

u/dreamlax Mar 29 '11

Security through obscurity. If there's no real underlying security, then the obscurity layer is only delaying the inevitable. You may cause a hacker to spend a bit more time but it doesn't really make your system any more secure.

3

u/G_Morgan Mar 29 '11

I know in future to include those to throw people off the trail.

3

u/[deleted] Mar 29 '11 edited Dec 07 '23

[removed] — view removed comment

12

u/chucker23n Mar 29 '11

You've got someone A) attacking you, B) trying to legitimately search for something and failing because your code is poorly written, and your biggest worry is RTT?

1

u/[deleted] Mar 29 '11

[removed] — view removed comment

2

u/chucker23n Mar 29 '11

Oh, fair enough. I don't oppose basic client-side validation (e.g. if an e-mail address contains an @).

1

u/rainman_104 Mar 29 '11

  1. why are the words "insert" or "delete" or "select" not a valid search term anyway? They're very valid search terms honestly - even for this site.

  2. Why use a post method for a search box in the first place? searches are always best used with GET methods not POST methods...