what is an SQL Injection?

#sqlserver #SQLinjection #database

[gio]

I work for altoro, I can't believe you did us dirty

[laughingvampire]

every time I see the term SQL injection I think of PHP, because I'm a GenX dev and I was there when PHP became popular and dethroned PERL as the preferred web scripting language. The irony is that PHP became famous because it is extremely insecure as a programming language and almost everyday of the late 1990s and early 2000 security news were about some PHP site being hacked by SQL injections.

PERL otoh came with a security feature that forced you to use any method to parse and check the data of anything that came outside of the computer, anything from sockets including a request had to be parsed in some way, usually a regex, and if the perl dev read the manual properly would avoid injections which it happen. PERL throws an error of "tainted variable" if you want to use it without parsing it. PERL5 at least I don't know if PERL6 does it.

[vexperian]

Literally just did a module on this today, cool stuff!

[hackdonalds]

this is soooo relevant! if you live in 2002

[theluckydragon]

can you make a video about AI training on the cloud or fine tuning one ?

[HentA.I]

and thats why you use prepared statements

[Alec]

My preferred method of preventing injection when building a web app is parameterised statements.
Send the query with placeholders, and send the strings to replace the placeholders.

[scriptles]

my favorite injection is "'or ''=' lol

[catharsis]

What if the child’s first name is really Drop and the last name is Table?

[tykbyvj]

My favorite injection is ' OR '5'='5' /* lol

[abdurrahimaykut]

This is good but old cuz so many website have protection to this so probably this works only for old websites or maybe some of the http websites. After all thank to chunk he teach us this attacks free

[phoenixmotorsport]

ANY website that still allows that to happen these, the company that owns it should never be allowed to hold data ever again - there really is no excuse

[Qyfashae]

Cant wait to see the faces of the SoC Team that needs to work Saturday and Sunday for Altoro

[gavril]

Why do people still pronounce like that, it's S Q L not Sequel

[nowieszco]

It would be useful.. like 20 years ago 😅

[stevenwilliamsknights]

Omg. I wish someone had moved it and progressed to check for this. Lol. If you know. You know.

[borregoayudando]

where is the rest of the explaination?

[seasong]

Pretty wild, but pycharm used to actually warn you, if you wrote code, which would make sql injections possible

[healingwithlove]

exploiting old sites that uses php and MySQL is easy but finding them is hard

[TheBigOTech]

lol are the days of SQL injection my friend