Re: Secure Regular Expression Check

Use the regex to untaint the user-entered string:

my $GOOD_NAME = qr/^(us\w*)/i;

my ( $accepted_name ) = $entered_un =~ /$GOOD_NAME/
    or die "Unacceptable input: $entered_un";

$sql = "select name, pass from unpw where name = '$accepted_name'";
[download]

Comment on Re: Secure Regular Expression Check Download Code

Replies are listed 'Best First'.
Re^2: Secure Regular Expression Check by andreas1234567 (Vicar) on Sep 10, 2008 at 08:28 UTC
`$sql = "select name, pass from unpw where name = '$accepted_name'";` [download] No, please don't recommend that. As Fletch writes above, that's still trivial to bypass. It's far too easy to write a regexp that will slip something unwanted through, which would, when not combined with placeholders or `DBI::quote`, represent a security risk. Use placeholders. Update: Revoked statement on triviality. -- No matter how great and destructive your problems may seem now, remember, you've probably only seen the tip of them. [1]	[reply] [d/l] [select]

Replies are listed 'Best First'.

Re^2: Secure Regular Expression Check
by andreas1234567 (Vicar) on Sep 10, 2008 at 08:28 UTC

$sql = "select name, pass from unpw where name = '$accepted_name'";
[download]

As Fletch writes above, that's still trivial to bypass

DBI::quote

Use placeholders.

Update: Revoked statement on triviality.

--
No matter how great and destructive your problems may seem now, remember, you've probably only seen the tip of them. [1]

[reply]
[d/l]
[select]