Advanced Dynamic Search Queries and How to Protect Them by Eitan Blumin

Language: Hebrew
No, it’s not yet another presentation about SQL injection. We all know how to protect from SQL injections already. But that’s only relevant when you know in advance which columns can be queried by the user and using what kind of operators (“equals”, “like”, “between”, etc.). Instead, what I really want to talk about is when you actually don’t know in advance which parameters to expect, you don’t know in advance the chosen operator to use per each parameter, and you actually want to give the user truly full unlimited control over search criteria. We’ll discuss different methods of achieving advance scenarios, the pros and cons of each, and most importantly: How do you do it without fear of malicious attacks.