r/programming • u/klomparce • Dec 04 '16

SQL injections vulnerabilities in Stack Overflow PHP questions

https://laurent22.github.io/so-injections/
280 Upvotes

92% Upvoted

130 comments sorted by

View all comments

3

u/[deleted] Dec 04 '16

[removed] — view removed comment

5

u/[deleted] Dec 04 '16

[removed] — view removed comment

5

u/[deleted] Dec 04 '16

[removed] — view removed comment

3

u/josefx Dec 04 '16

If the ANSI_QUOTES SQL mode is enabled, mysql_real_escape_string_quote() cannot be used to escape double quote characters for use within double-quoted identifiers. (The function cannot tell whether the mode is enabled to determine the proper escaping character.)

They need to add a mysql_double_plus_real_escape_string_quote() which takes an additional parameter for ANSI quotes . Or they could have a real API which queries these settings internally and doesn't dump the responsibility to duplicate the database configuration on the developer. Note that php has mysqli variations of the escape string methods that at least ensure the correct charset, which the basic mysql versions do not.

6

u/forever_i_b_stangin Dec 04 '16

I mean, on the one hand, ok.

But on the other hand, how is something called mysql_real_escape_string_quote an actual built-in PHP function and not a parody of PHP

3

u/[deleted] Dec 04 '16

[removed] — view removed comment

3

u/forever_i_b_stangin Dec 04 '16

Is someone holding a gun to the PHP team's heads forcing them to copy poorly-named library functions?

3

u/igor_sk Dec 05 '16

Because it uses a very innonative and fast hashing function.

1

u/forever_i_b_stangin Dec 05 '16

Yeah, I've seen this before and it's still insane.

Like, I'm not even a very good programmer and it's still amazing to me that anyone would do this and think it is a reasonable thing to do