BeautyandBoost.com
Music
Cute article about sanitizing form input…
…found this next snippet in the authentication code for the project he’d been assigned to.
// The following string is an SQL comment, and could // blank out the check for password in our SQL statement // if used in the username! if (username.indexOf("';--")!=-1) { throw new AuthorisationException(username +" given as login name contains ';--, this is bad for SQL!"); } // Get the (hopefully single) id of the player with // this name and password ResultSet authorised = statement.executeQuery( "SELECT id FROM table_name_redacted WHERE " + "username='"+username +"' AND password='"+password+"';");It’s a bit better, but doesn’t quite fool the hacker who uses the “‘; –” attack instead of “‘;–”.
Related Posts: On this day...
- Apple's iPhone launches no longer excite - 2012
- Zahra's Paradise: A graphic novel about Iranian uprising is a story and a history - 2011
- Password Reuse - 2010
- (1) Open a Linux terminal, (2) Enter "cal 9 1752", (3) wtf? - 2009
- TxtNinja Stashes Your Text Inside Images - 2009
- University Brings Charges Against White Hat Hacker - 2008
