Slashdot Mirror

But something like
';drop tables.

http://bobby-tables.com/

Anyone developing software needs a clue about names, and about unicode and text encodings.

http://www.kalzumeus.com/2010/...

http://www.joelonsoftware.com/...

(Then learn lots, lots more about text encodings).

Also, whether or not they use SQL directly, about metacharacter attacks and SQL injection:

http://bobby-tables.com/

http://watchguard.com/infocent...

People are still writing code vulnerable to SQL injection attacks?

Yes, they are. It doesn't help when lots of online tutorials give crappy information, like saying to use mysql_real_escape_string in PHP instead of a proper parameterized query. (Using the escape function is better than nothing, but it's not foolproof and is needlessly convoluted.)

This tutorial, which ranks first on Google when I search for 'php sql', uses the escape method and does not mention parameterized queries at all. (The correct method is described here.)

If "most engineers are not morons" then we wouldn't need Bobby Tables as an example when explaining simple security issues to them.

Adobe's level of public irresponsibility is crazy. Every week new vulnerabilities are found in Flash and Reader – more often, and more serious security holes, than in Windows, even though Windows is a whole OS and these programs should be much easier to keep bug-free in comparison. And now we find that they can't even keep their own internal databases safe. Preventing SQL injection really isn't that difficult; there are plenty of websites that tell you what you need to do. Just using parameterized queries will weed out most of the common SQL exploits. How much of Adobe's programming is being conducted now by people who just don't have any fucking idea what they're doing?

There really needs to be a good alternative to Photoshop (no, GIMP doesn't count). Flash needs to be phased out as quickly as possible, and people need to stop using Adobe Reader if at all possible, and try to move away from any Reader-specific PDF "features". Most people who use the full version of Acrobat are wasting their money (it's amazing how many people have it installed just so they can print to PDF, when there are free programs that do the exact same thing just as well).

http://bobby-tables.com/ Obligatory response.

Bobby Tables: A guide to preventing SQL injection

bobby-tables.com: A guide to preventing SQL injection

http://bobby-tables.com/

you're obviously an idiot or a troll, so no example needed buchner.johannes'); DELETE FROM TABLE comments WHERE uid='1139593'; DELETE FROM TABLE users WHERE uid='1139593';-- http://bobby-tables.com/