RE: securing web form interaction

[prev] [thread] [next] [Date index for 2005/02/15]

From: Adam Prime x443
Subject: RE: securing web form interaction
Date: 21:13 on 15 Feb 2005

Assuming you aren't doing anything really weird anyway, like passing a =
table name as a get argument to a script or something.

The whole point of using placeholders or $dbh->quote is that you don't =
trust anything that comes from the client to actually be valid.  If you =
want to be sure that you aren't vulnerable to SQL injection attacks, or =
cross site scripting attacks, or probably a whole lot of other things, =
you can do sanity checks on anything you're getting from the client. =20

adam

-----Original Message-----
From: Octavian Rasnita [mailto:orasnita@xxx.xx]
Sent: Tuesday, February 15, 2005 2:19 PM
To: Ian Joyce; Adam Prime x443
Cc: Mod-Perl ((E-mail))
Subject: Re: securing web form interaction


Hi,

I usually use placeholders in DBI. Is this enough for avoiding SQL
injections?
I have made a simple test and I have seen that it seems to be enough, =
but...
I am not sure.

Thanks.

Teddy

(message missing)

securing web form interaction
Jonathan Vanasco 18:02 on 15 Feb 2005

Re: securing web form interaction
ben syverson 18:36 on 15 Feb 2005

Re: securing web form interaction
Arshavir Grigorian 14:41 on 16 Feb 2005

Apache::Request equivalent of CGI::Capture?
David Naughton 21:48 on 16 Feb 2005

Re: Apache::Request equivalent of CGI::Capture?
Adam Kennedy 01:52 on 17 Feb 2005

Re: Apache::Request equivalent of CGI::Capture?
Joe Schaefer 02:22 on 17 Feb 2005

Re: securing web form interaction
Sean Davis 18:40 on 15 Feb 2005

RE: securing web form interaction
Adam Prime x443 19:07 on 15 Feb 2005

Re: securing web form interaction
Ian Joyce 19:09 on 15 Feb 2005

Re: securing web form interaction
Octavian Rasnita 19:19 on 15 Feb 2005

Re: securing web form interaction
Perrin Harkins 20:24 on 15 Feb 2005

RE: securing web form interaction
Adam Prime x443 19:11 on 15 Feb 2005

Re: securing web form interaction
Malcolm J Harwood 21:19 on 15 Feb 2005

Re: securing web form interaction
Octavian Rasnita 19:20 on 15 Feb 2005

Re: securing web form interaction
ben syverson 20:33 on 15 Feb 2005

Re: securing web form interaction
Octavian Rasnita 08:10 on 16 Feb 2005

RE: securing web form interaction
Adam Prime x443 21:13 on 15 Feb 2005

Re: Apache::Request equivalent of CGI::Capture?
Stas Bekman 03:40 on 17 Feb 2005

Re: Apache::Request equivalent of CGI::Capture?
William McKee 14:49 on 17 Feb 2005