Re: Question: is this exploitable?

[Paul Tinsley <pdt () jackhammer org>]

I don't believe this is a true statement.

Perldoc on the quote function:
     "quote"
            $sql = $dbh->quote($value);
            $sql = $dbh->quote($value, $data_type);

          Quote a string literal for use as a literal value in an SQL 
state-
          ment, by escaping any special characters (such as quotation 
marks)
          contained within the string and adding the required type of outer
          quotation marks.

Perldoc on "Placeholders and Bind Values" or "execute" or "do" doesn't 
actually say anything about escaping special characters, but it does do 
it.  So in my opinion, for those who don't magically know that prepare 
with placeholders will take care of the problem quote is the natural 
choice...

Looking at the code shows that using the quote routine or placeholders 
end up being quoted exactly the same way.  Quote does it directly, with 
placeholders making it down the path via: 
[execute|do]->mysql_st_internal_execute->ParseParam->mysql_real_escape_string.

Function called from either path (excerpt from mysql.h):
unsigned long STDCALL mysql_real_escape_string(MYSQL *mysql,
                                              char *to,const char *from,
                                              unsigned long length);

I personally prefer the placeholder method myself, but quote does the job.

---------
Paul Tinsley

"There's More Than One Way To Do It"
 -- Larry Wall


Jonathan A. Zdziarski wrote:

> Eh? How does this prevent a sql injection exploit?  Placeholders (as was
> previously suggested) are really the only way to accomplish that.
>
>  
>
> > $query=sprintf("insert into projects values(null,%s)",dbh->quote($project));
> > $sth = $dbh->prepare($query);
> >    
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>  


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html