[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-Disclosure] Question: is this exploitable?
- To: "Jonathan A. Zdziarski" <jonathan@nuclearelephant.com>
- Subject: Re: [Full-Disclosure] Question: is this exploitable?
- From: Paul Tinsley <pdt@jackhammer.org>
- Date: Sat, 18 Oct 2003 21:36:20 -0500
I don't believe this is a true statement.
Perldoc on the quote function:
"quote"
$sql = $dbh->quote($value);
$sql = $dbh->quote($value, $data_type);
Quote a string literal for use as a literal value in an SQL
state-
ment, by escaping any special characters (such as quotation
marks)
contained within the string and adding the required type of outer
quotation marks.
Perldoc on "Placeholders and Bind Values" or "execute" or "do" doesn't
actually say anything about escaping special characters, but it does do
it. So in my opinion, for those who don't magically know that prepare
with placeholders will take care of the problem quote is the natural
choice...
Looking at the code shows that using the quote routine or placeholders
end up being quoted exactly the same way. Quote does it directly, with
placeholders making it down the path via:
[execute|do]->mysql_st_internal_execute->ParseParam->mysql_real_escape_string.
Function called from either path (excerpt from mysql.h):
unsigned long STDCALL mysql_real_escape_string(MYSQL *mysql,
char *to,const char *from,
unsigned long length);
I personally prefer the placeholder method myself, but quote does the job.
---------
Paul Tinsley
"There's More Than One Way To Do It"
-- Larry Wall
Jonathan A. Zdziarski wrote:
Eh? How does this prevent a sql injection exploit? Placeholders (as was
previously suggested) are really the only way to accomplish that.
$query=sprintf("insert into projects values(null,%s)",dbh->quote($project));
$sth = $dbh->prepare($query);
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html