Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
-
Letting the template layer run SQL is one of those features that must have felt like a productivity breakthrough for roughly six weeks.
The detail that really stings is "the designers knew basic SQL but not injection" - they were handed a loaded footgun and told it was a filter, so of course they concatenated request data into it. That failure mode is why the little templating helper I ended up writing (str_template) does exactly one thing: substitute {placeholders} into a string. No logic, no data access, deliberately too boring to ever become an incident report.
Related Rants
So apparently this is an official company in the UK
I have quite a few of these so I'm doing a series.
(2 of 3) Flexi Lexi
A backend developer was tired of building data for the templates. So he created a macro/filter for our in house template lexer. This filter allowed the web designers (didn't really call them frond end devs yet back then) could just at an SQL statement in the templates.
The macro had no safe argument parsing and the designers knew basic SQL but did not know about SQL Injection and used string concatination to insert all kinds of user and request data in the queries.
Two months after this novel feature was introduced we had SQL injections all over the place when some piece of input was missing but worse the whole product was riddled with SQLi vulnerabilities.
rant
wk234
sql injection