in reply to Re^2: SQL Injection myths under DBI
in thread SQL Injection myths under DBI?
my ($id) = $dbh->selectrow_array("SELECT id FROM users WHERE NAME='$na +me' AND PASSWORD='$password'");
If I somehow manage to break the SQL statement in $name, my password will not be checked! Without a good quoting mechanism, you could break that with
or even$name = "admin\'\0";
Or whatever kind of escapes your specific DBD/database combination will allow. This is the main reason for using $dbh->quote() and placeholders - the quoting mechanism can be different for different databases, and they are a little more complex than you imagine. In effect, all you're doing is trying to reinvent the $dbh->quote() method.$name = "admin';";
Why reinvent the wheel when there already is one that's been especially made for your type of car, has been checked and double-checked, and is already safely attached to your car?
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re^4: SQL Injection myths under DBI
by itub (Priest) on Apr 12, 2005 at 14:02 UTC |