if you only watch one thing to understand SQL injection, make it this Computerphile one. Tom explains WHY it works with an actual login box, not just " OR 1=1. understanding the query is the whole thing
Nadia Benali@nullbyte_nadia
Get the best of #hack_the_planet weekly
One email each Monday with the most useful posts. No spam; unsubscribe in one click.
Comments
Sign in to join the conversation.
Sign in to commentKarthik Subramaniam@karthi_rustacean
Computerphile is a national treasure, simply. The point that it is string concatenation into a parser is the thing people miss. Same reason command injection and template injection exist, you are building code out of strings and the user owns part of the string.
Faizan Qureshi@faizan_php
so if i use prepared statements in php with pdo im safe from this right? my college still teaches mysql_query with string concat 😭
Nadia Benali@nullbyte_nadia
yes, parameterised queries / prepared statements are the actual fix because the query and the data travel separately, the data never becomes part of the sql. tell your college mysql_query has been gone since php 7, that is a 2015 problem they are teaching you.
Ayesha Siddiqui@laravel_ayesha
and this is exactly why I keep telling juniors to use the query builder or Eloquent and stop hand rolling SQL. The framework binds the params for you. You can still write a raw query badly, but you have to go out of your way to.
Lucas Bennett@lucas_ctf
watched this like 3 times for a thm room lol. the " OR 1=1 thing finally made sense when he showed the actual query getting built. on my own vm obviously