6 ms·
And no SQL keywords allowed in passwords. Because they like to advertise that they don't bother escaping user input before concatenating sql strings to store pl
by SimHacker 12y ago
And no SQL keywords allowed in passwords. Because they like to advertise that they don't bother escaping user input before concatenating sql strings to store plain text passwords in the database.
http://stackoverflow.com/questions/13738141/blacklist-filtering-data-for-sql-keywords http://stackoverflow.com/questions/13738141/blacklist-filter...
- krapp 12y agoI'd bet that patterns like $db->execute("INSERT INTO USERACCOUNTS ('username','password') VALUES ('".$_POST['username']."','".$_POST['password']."')"); are more common than anyone wants to believe.
- SimHacker 12y agoThe PHP manual pages are full of user comments with helpful suggestions just like that, which incompetent programmers copy and paste into production systems. But I think of it as a good thing, an instance of evolution in action, because banks that hire such stupid programmers deserve to have all their money stolen from them.