Waste of chemical waste.
Bound check all data input, folks.
Ideally during input and on the API request.
if (str_contains($order['comment'],'Shrek')) { die('ONIONS HAVE LAYERS!'); }Please implement your Shrek checks responsibly
VARCHAR2(256)
Yay I fixed it.
i shouldn’t have laughed this hard. reminds me of the time we got a substitute for computer class who didn’t know anything about computers. after 45min. of her typing into word she asked the class what the shortcut for quicksaving was. my friend who loves to clown answered “alt+f4”. needless to say she wasn’t happy with the result…
good times
thinking about it… that was a real dick move
Isn’t that how you trim someone’s armor in RuneScape?
You have to trade your armor to someone and then on the trade back hit alt f4 before accept, then it bugs out and gets trimmed in your inventory
I bet she learned that shortcut though 😁 Have you ever heard of BOFH series? We are all dicks.
The Bastard Operator From Hell…
I still don’t understand it after all these years.
https://en.wikipedia.org/wiki/SQL_injection?wprov=sfla1 the “Root cause” section might explain it well for you.
')closes the input for the original sql statement. So the actual input would be “Robert”, but it’s not really important for this kind of attack.
;says that the statement is over and anything after is a new statement.
DROP TABLE customer;is that new statement, which deletes a table with the name “customers”.
--is the syntax for an sql comment. It effectively makes sure that any other sql statements in the actual script get ignored, so you don’t get a compile error.This is an effective attack for when some programmer uses unsanitized string instertion in their sql script. In this case I could imagine a statement like:
SELECT id FROM users WHERE name == {user_input};where{user_input}is the literal, unsanitized input that you give on the website.Notice that in this case, the
')doesn’t do anything, but it just becomes part of the input, so that is now “') Robert”.The obvious parade here is to be semi-illiterate when you create your database and name your field “costumer”
Spot on.
As for the sanitisation, it can take many forms. Either characters that don’t usually appear in the context for that field (in terms of names, you can usually scrub most parentheses, more than one hyphen in a row etc) can be removed; copy it to a known encoded field such as unicode to get rid of characters with unusual properties; and making sure bounds are enforced to avoid overflows.
It should mean that your data is exactly that - raw data, and not commands or operands for the interpreter to act upon.
Parameterisation entirely solves the problem without needing to sanitise the string
Not entirely (I recall seeing some obscure CVEs some years ago), but it’s a hell of a lot better than what some coders try to get away with.
Here’s an attempt at a non programmer explanation.
Companies use a SQL database to store their data. Think of it like an Excel file with multiple tables, storing rows and columns.
You modify the data with written statements, so you’d add a new row of data with a command like
add "John" to the users table. Crucially you can chain statements, so you could sayadd "Sally" to the users table and delete "Pizza" from the menu tableYou wouldn’t be writing this command out manually every time. Say you had a website, you’d write the command as
add "<USER>" to the users tableand then when the website user sends you their username, you replace <USER> with their name.So the user sends their name,
Robert, we replace <USER> with Robert and the command becomesadd "Robert" to the users tableBut you’re now open to a hack. What if Robert sends his name as
Robert" to the users table and delete the entire users tableYou’ve inserted that entire thing into your command, because that sentence will replace the <USER> part of your command. So your full command becomes
add "Robert" to the users table and delete the entire users table" to the users tableThis will delete your entire table. The second half of the command doesn’t make sense but it’s too late SQL has already deleted it.
The XKCD joke is somebody actually naming their child to execute the hack
Or a more simpler approach.
It could cause a database to delete all customer information.
Even simpler: shotgun blasts the physical machine
It’s more fun and exciting too!
Should have instituted a char limit, that’ll teach you!
Speaking of which - can someone find the link for “Unicode does not work like this” kind of website that emphasizes that there is no simple “character limit”? Like "how many characters is an emoji? " or “Is NBSP a character”, “are non-latin punctuation marks a character”
I tried to contact a company the other day about something with a complex back story of cobtext the other day, and their website contact us form had a 200 character limit. I pretty much just had to type “please email me so I can email back why I’m contacting you”.
Definitely wouldn’t use the dev console to try bypassing the limit.
That would be unethical.
Cannot imagine how this could be legit - you’d run into a hard limit unless you explicitly designed that field to be unbounded.
Meh, not that hard to default things to “string”, or similar. For example, the “text” type in PostgreSQL explicitly says “unlimited”, though it seems it’s up to 1Gb. See https://www.postgresql.org/docs/current/datatype-character.html
Similarly, it’s not like text fields on web pages automagically apply limits.
It’s not unimaginable that some dumbass could vibe-code themselves up an easily exploited form.
100% accurate, though vibe coding is optional.
If I have a set of requirements that don’t mention any type of restriction, then I won’t arbitrarily add one - as far as I know, I could be breaking intended functionality. If I’m invested in this, I’ll add it to the list of stuff that needs clarification, otherwise it’s gonna ship as specified, and eventually someone’s gonna file a change request.
These ‘unlimited’ scams are getting out of hand. All I wanted was to store the library of alexandria in plain text.
It’s not hard to find badly designed webpages.
Why does everything require “pov:”?
POV: you’re reading Lemmy comments
Well, at least it isn’t Bee Movie.
how nice of them.
Charge them $20 more: stupidity is a crime.
You mean stupidity of the programmer who did a bad job?
