Re: [Full-Disclosure] Question: is this exploitable?

[merlyn@stonehenge.com (Randal L. Schwartz)]

>>>>> "Paulo" == Paulo Pereira <pjp@paulo-pereira.net> writes:

Paulo> $sth = $dbh->prepare("insert into projects values(null,\"$project\")");

This clearly should have been:

  my $sth = $dbh->prepare("insert into projects values(null, ?)");
  $sth->execute($project);

which will Do The Right Thing.

Placeholders, people.  Placeholders.
-- 
Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777 0095
<merlyn@stonehenge.com> <URL:http://www.stonehenge.com/merlyn/>
Perl/Unix/security consulting, Technical writing, Comedy, etc. etc.
See PerlTraining.Stonehenge.com for onsite and open-enrollment Perl training!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html