Elliotte Harold wrote:
Kenneth Downs wrote:
Many things are a waste of the cracker's time, but they do them
anyway. So counting on the result not being worth the time of
cracker is wishful thinking. :-)
Even if one has full cell level security in the DB, I expect there are
still denial of service injection attacks that may not access any
cells at all. I'll leave it to the SQL experts to devise the nastiest,
exponential time problems they can express in SQL. Brownie points for
doing it in pure SQL without any vendor extensions. :-)
Even with db security you have to escape the strings to save things like
the name of our favorite publisher.
So the database has this row in it:
Name: Captian Cracker
Email:[EMAIL PROTECTED]
Company: O'Reilly
comments: I will kill your system';drop database social_networking
And you say, 'hmmm, that's an interesting comment.'
--
Kenneth Downs
Secure Data Software, Inc.
www.secdat.com www.andromeda-project.org
631-689-7200 Fax: 631-689-0527
cell: 631-379-0010
_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk
NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com
Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php
