Skip to Content.
Sympa Menu

freetds - Re: 4.2 limitation...

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Michael Peppler <mpeppler AT peppler.org>
  • To: "TDS Development Group" <freetds AT franklin.oit.unc.edu>
  • Subject: Re: 4.2 limitation...
  • Date: Thu, 4 Jan 2001 13:30:20 -0800 (PST)


mjn writes:
> > On Tue, Jan 02, 2001 at 11:51:49AM -0800, Michael Peppler wrote:
> > >mjn writes:
> > > > > my $sth = $dbh->prepare("SELECT * FROM authors WHERE state =
> > > > > \"$state\"");
> > > > $state='"ca"';
> > > $state = 'ca';
> > > my $sth = $dbh->prepare("SELECT * FROM authors WHERE state =
> > > '$state'");
> > >or use the q() and qq() operators, like so:
> > > my $sth = $dbh->prepare(qq(SELECT * FROM authors WHERE state =
> > > "$state"));
> >
> > But all of these are vulnerable to attacks which include whatever the
> > quoting character is - easily done if you're allowing outside input.
> > The DBI::quote function was designed specifically to get around this
> > problem, and will correctly quote _any_ string for use by the relevant
> > database.
> >
> > $state=$dbh->quote($state);
> > my $sth=$dbh->prepare("SELECT * FROM authors WHERE state = $state");
>
> So what about using:
>
> @configuration = qw(value1 value2 value3)
>
> to pass information? Is this unsafe like the rest of the instances we
> have mentioned?

The problem is with char input that comes from a non-trusted source
(typically a CGI program) where clever use of the single and/or double
quote could cause some unwanted SQL to get executed.

For example:

"update foo set xyz=1 where bar='$var'"

Now if $var = "mpeppler' delete from foo where bar!='" you could end
up with rather unwanted results...

For strings that are hard-coded in your program there is nothing to
worry about.

Michael
--
Michael Peppler - Data Migrations Inc. - mpeppler AT peppler.org
http://www.mbay.net/~mpeppler - mpeppler AT mbay.net
International Sybase User Group - http://www.isug.com
Sybase on Linux mailing list: ase-linux-list AT isug.com




Archive powered by MHonArc 2.6.24.

Top of Page