- all web input needs to run thru the same filter - that filter disallows SQL ke... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

sabat on July 7, 2008 | parent | context | favorite | on: SQL "development" gone horribly wrong...

- all web input needs to run thru the same filter - that filter disallows SQL keywords - you're done

If this guy wasn't on a shared host, he could just install mod_security and its default config should take care of it. Presuming Apache of course.

LogicHoleFlaw on July 7, 2008 [–]

I think ANDrew, TOny, SETh, and BYron might have problems with that filter.

sabat on July 8, 2008 | [–]

They might if the programmer didn't have the sense to surround the keywords with word boundary markers. You know, something like %20SET%20 etc. I do this successfully with mod_security, and a good regex kit will let you do this easily.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact