Is MySQL more resistant to SQL injection attack than PostgreSQL (under Perl/DBI)?

前端 未结 4 629
误落风尘
误落风尘 2021-01-06 08:12

I am reviewing a Linux based perl web application that contains a login handler with the ubiquitous

my $sth = $DB->prepare(\"SELECT password from passwords where use

4条回答
  •  一向
    一向 (楼主)
    2021-01-06 08:38

    It might be difficult, if not impossible, to have a generic sanitizer against SQL injections.

    Added [As commented, using the DBI correctly and with the help of the DB's client library, the injections can certainly be minimized with respect to preparing the SQL statement. However, it's important to keep in mind that sanitizing user input also involves application logic which is independent of the DB used. For example, using another user's credentials may provide a valid and safe statement, but with unintended consequences. Anyway, that's going further than the question asked.]

    Removed [You're better off sanitizing the input yourself rather than having any sense of false security on the client's resistance to these types of attacks. Not that you shouldn't use them, just don't assume they provide more than minimal help against the attacks.]

提交回复
热议问题