tech reporting: not so grate aktually

[necaris]

Er, what? SQL injection is a complicated technique these days?

Come on, it's in XKCD, for heaven's sake, it's not that bloody complicated...

(In other news, remind me never to use my credit card in the US again; if that many payment providers don't sanitize their database inputs, there is little hope for the web development world...)

Comments

[thecapitalc]

Perhaps it's worth considering that most people who read XKCD also come from that self- selecting subset who don't think this technique is complicated?

...

just musing ;)

How's everything else?

[necaris]

Well, sure, but it's among the most trivial of exploit techniques to protect against -- seriously, it's Database-Backed Software Development 101. If the people who are processing credit card payments aren't protecting against something so simple, then ... :-(

I will hopefully post about Other Things soon. This just caught my eye.

[tyr_arcana]

From the wording of that article it sounds more like these were internal databases, not meant to be accessed from outside their offices/vpn's... still, they should have injection protection to guard against malicious employees, regardless.

[necaris]

Unless the crackers managed to get in and start issuing raw queries to their DB server, there's no excuse for letting them inject arbitrary SQL :-)