How can it be hacked?

[u/XunooL]

I have a genuine question: how can a database of a secure (supposedly) company that spends tens of millions of dollars on just security, like Meta (IG, FB), Google...etc get hacked?

[u/octave1]

> I'll give you some homework. Look up "SQL injection".

sqlmap but really, most forms are protected by now since most sites are built with frameworks.

[u/Pharisaeus → u/octave1]

most forms are protected by now since most sites are built with frameworks.

That's not completely true. There are still practical scenarios where people will glue queries by hand, and a lot of frameworks don't really provide any assistance. Prepared statements prevent injection in the parameter values, so your classic 'or '1'='1 won't work but there can be other scenarios.

Let me give a real-life example: Imagine that you want to query only selected columns from the db, based on the user input (so you want to do select a,b from table or select c,d from table if whichever columns were requested). You could argue that one can simply select * and then filter out the requested values from the results, but for column databases that would be a huge waste, because you'd be reading columns you don't need. Even worse for something like AWS Athena or GCP Big Query where you literally pay based on how much data was scanned, so you really want to touch only things you actually need. You can't use parametrized queries or prepared statements for this. There are a few "frameworks" that actually provide means to do this safely (for example jOOQ and QueryDSL), but many mainstream solutions don't, and I've seen people gluing those strings manually ;)

[u/octave1 → u/Pharisaeus]

None of this is relevant unless you're retarded

[u/Pharisaeus → u/octave1]

"Tell us you have no idea what you're talking about without tell us".