SQL injection... Web programming with Databases? Watch this

[Ethnod]

I dont do any php or Sql any more but wow

 

Video Link: http://www.youtube.com/watch?v=_jKylhJtPmI

 

Source:

http://gizmodo.com/what-the-hell-is-a-sql-injection-anyway-1443364642

[Emkryan]

Computerfile

[MikeD]

Welcome to the Internet!
While you are on the SQL Injection train, which, by the way, can be solved with stored procedures and input sanitation, you might want to look at Cross Site Scripting, PHP file/shell/eval injection or overflows (stack smashing, heap/BSS overflow, index overflow, format overflow) in, for instance, CGI scripts (or any C program).

And then you can move on to covert channels, sniffers, ARP spoofing, MAC flooding, IP spoofing, TCP hijacking, SYN flooding, ICMP "SMURF", DoS with Chargen and Echo, ping-of-death, teardrop attack, land attack, the Kasminsky DNS attack.

And then you can move on to flaws in encryption or hashing mechanisms (replay attacks, sign and cipher order that can lead to message stealing, key management and distribution, granting perfect forward secrecy), weaknesses in authentication mechanisms or wireless protocols, ...

 

The world of computer and network security is huge, and there are new vulnerabilities being discovered at the same pace, or even faster, than new security technologies are coming out. That's one of the reasons why it's not sufficient to have programming (read coding) skills, you need to know much more than a couple of languages to be able to develop a secure piece of software and make it available to the world via the internet.

[WanderingFool]

I find they don't really teach security in school.  In both web development and my database class, I saw teacher examples of exploitable code....it made me cry inside.

 

It is just a shame that the "easier" way seems to always be the exploitable way

[Stormsys]

Prepared Statements and generic database interfaces like PDO address these issues, and there's one simple rule with PHP(or any language that is not auto-magically sanitizing your data) ... anything coming from user input treat it as if it were tainted, regex the shit out of it length checks ect and that will minimize the risk even not using prepared statements.

 

 

-- note i wrote this before the video ended the guy does talk about it kinda , i wouldn't really call it a hack its basically using the database(depending on implementation) to process the input logic rather then the script langue because it runs on the sql server(you issue a command to prepare the statement then to ingest data).

[Flojer0]

I saw this when it came out. I'm currently in the process of building a website to show of my personal works and views in the tech world. Looks like I have a long road to go to make my site secure and well built.