satan's little suckass demonstration

In response to my query for addresses, Jesse recommended this, and…

12/18/07 08:08 am

In response to my query for addresses, Jesse recommended this, and it made me LOL:

Use this address if you are sending using a Postal Service bar code: Little Bobby Tables 1337'; Drop table big_bro_breadcrumb_log; -- Los Angeles, CA 90015

See here for the reference...

Current Music: "NPR News: 12-17-2007 10AM ET" – NPR

12/18/07 04:07 pm (UTC) - wasabi

I get that some part of that creates a bad Unix command? And how does one "sanitize" their data input?

please to be enlightening? your code-fu is strong.

12/18/07 04:20 pm (UTC) - greck

yeah on web sites in particular, you run everything a person types in through some kind of routine that filters out "dangerous" things that can hijack SQL (database) queries. so for example, if the back-end code had a query like

SELECT * FROM Students WHERE name='<web form data>'

and you punch in Bob Dole'); DROP Students; --

then the query becomes

SELECT * FROM Students WHERE name='Bob Dole'); DROP Students; --'

because the ; means "end of statement" which causes the first overstruck part to error or execute "short", and the -- means "everything after is a comment", so makes the rest of the line is not run. leaving you with not-what-you-wanted results. :-)

so, you sanitize user input by filtering out semicolons, --, etc... anything that can trip up parsing later.

Edited at 2007-12-18 04:23 pm (UTC)

12/20/07 12:50 am (UTC) - naygoo

I tried so hard to find some little bit of this funny, but I could not.
Thread
Reply
- 12/20/07 10:01 pm (UTC) - greck
  
  yeah, it's a pretty inside kinda joke.... :-)
  Parent
  Thread
  Reply

Log in

satan's little suckass demonstration

12/18/07 08:08 am

12/18/07 04:07 pm (UTC) - wasabi

12/18/07 04:20 pm (UTC) - greck

12/20/07 12:50 am (UTC) - naygoo

12/20/07 10:01 pm (UTC) - greck