Posts by Dominic

Christian group declares jct 9 on M25 cursed

or they could do something useful

Like tidy up the discarded cassettes and putting them in the bin. Surely that would solve the problem and actually achieve something in the process?

/grumpy old git

Tory £12bn public sector cuts proposal would claim IT scalps

Cut Govt IT costs by 50%

It's pretty easy. Stop paying £800/day for a Crapita/EDS/Logica consultant and get in an independant contractor who will do it for £400/day.

Blade Runner tops sci-fi movie poll

bring back the sick vulture icon

Wot no Highlander II?

Next-gen SQL injection opens server door

@Damien Thorn

Or you could just bind your variables and not have to worry about it. Of course that would mean hiring someone who knows what they are doing. Not popular in this day and age.

BMW driver follows satnav to edge of cliff

What a moron

Someone needs to take away his licence for being too stupid to be allowed out without a carer. Learn to read a map you retard.

More execs quit Phorm

Phorm free ISP's?

Any suggestions as to which internet provider I should switch to? Phorm free naturally.

SQL attacks inject government sites in US, UK

@Lee

set serveroutput on size 1000000

drop table sql_injection_test

/

create table sql_injection_test

(username varchar2(10),

password varchar2(10))

/

insert into sql_injection_test

(username,

password)

values('user',

'test')

/

create or replace procedure sql_inj_test(in_user VARCHAR2,

in_pwd VARCHAR2) as

v_string varchar2(2000);

found_user varchar2(1);

begin

dbms_output.put_line('first run with bind variables');

v_string := 'select DECODE(count(*),0,'||''''||'N'||''''||','||

''''||'Y'||''''||')'||

' from sql_injection_test '||

' where username = :1 and password = :2';

execute immediate v_string into found_user using in_user, in_pwd;

if found_user = 'Y'

then

dbms_output.put_line('found user, ok to connect');

else

dbms_output.put_line('invalid user. Exit');

end if;

dbms_output.put_line('now run without bind variables');

v_string := 'select DECODE(count(*),0,'||''''||'N'||''''||','||

''''||'Y'||''''||')'||

' from sql_injection_test '||

' where username = '||''''||in_user||''''||

' and password = '||''''||in_pwd||'''';

dbms_output.put_line(v_string);

execute immediate v_string into found_user;

if found_user = 'Y'

then

dbms_output.put_line('found user, ok to connect');

else

dbms_output.put_line('invalid user. Exit');

end if;

end;

/

prompt *** sql_inj_test('user','test') ***

begin

sql_inj_test('user','test');

end;

/

prompt sql_inj_test('user','dunno'||''''||' or '||''''||'a'||''''||' = '||''''||'a');

begin

sql_inj_test('user','dunno'||''''||' or '||''''||'a'||''''||' = '||''''||'a');

end;

/

@Lee

When you bind the variable, the query is parsed as eg (select x,y.z from t where v = :1) it then passes the string into the bind variable and runs the parsed query. No way this can be open to sql injection as the query is parsed before any dodgy strings are processed

@Andrew Thomas

As Steve has already said, bind your frikkin variables and no SQL Injection problem. This is exactly why java script monkeys shouldn't be allowed with 100 yards of a proper application. It doesn't need sophisticated coding structures, just someone who knows what they are doing

Microsoft and HP tackle SQL-injection scourge

Oh god not again

Bind the frikkin variable and the whole problem goes away. Any database developer that lets a Java script monkey anywhere near their code needs shooting.

New attack technique threatens databases

Or you could...

Sack the 'tard for not using bind variables in his sql code and get someone who knows what they are doing to do the work. It's not as if Tom Kyte hasn't been banging on about this since the beginning of the millenium.

Sick vulture because it could swallow a program spec and puke better code than that.