7 ms·
Out of curiosity, do these attack vectors still apply to MySQL prepared statements? From his query example, the prepped version would read "SELECT id,name,pass
by Rust 17y ago
Out of curiosity, do these attack vectors still apply to MySQL prepared statements? From his query example, the prepped version would read "SELECT id,name,pass FROM users WHERE id = ? AND pass = ?" and the two parameters would be passed in as an array of strings.
- DrewHintz 17y ago> do these attack vectors still apply to MySQL prepared statements? No.
- tptacek 17y agoSure they do. All you have to do is find a query that uses user input to select a table, or that accepts an offset for pagination and doesn't explicitly typecast it. We find SQLI in parameterized queries all the time. You should absolutely use prepared statements, but don't kid yourself about their magic powers.