Skip to main content
replaced http://stackoverflow.com/ with https://stackoverflow.com/
Source Link

I think you miss the point of Bobby Tables. The idea is to introduce the concept of SQL injection. The problem is that SQL injection, from a practical standpoint, is hard to give an example that is one-size-fits-all. It depends a lot on how you set your tables up, the data being held, how you're writing your queries, and what you do with the data after you pull it.

The real trick here is to get people to think about security at all. Like Shog said, most of the questions on SO are about making it work, period ("Plaese! I must have tomorrow or will fired!"). Sometimes raising awareness of security is all you can do.

So, no, a multi-query injection attack is not likely to succeed in PHP for the reasons you stated. But it does make for a pretty good primer into the topicpretty good primer into the topic

I think you miss the point of Bobby Tables. The idea is to introduce the concept of SQL injection. The problem is that SQL injection, from a practical standpoint, is hard to give an example that is one-size-fits-all. It depends a lot on how you set your tables up, the data being held, how you're writing your queries, and what you do with the data after you pull it.

The real trick here is to get people to think about security at all. Like Shog said, most of the questions on SO are about making it work, period ("Plaese! I must have tomorrow or will fired!"). Sometimes raising awareness of security is all you can do.

So, no, a multi-query injection attack is not likely to succeed in PHP for the reasons you stated. But it does make for a pretty good primer into the topic

I think you miss the point of Bobby Tables. The idea is to introduce the concept of SQL injection. The problem is that SQL injection, from a practical standpoint, is hard to give an example that is one-size-fits-all. It depends a lot on how you set your tables up, the data being held, how you're writing your queries, and what you do with the data after you pull it.

The real trick here is to get people to think about security at all. Like Shog said, most of the questions on SO are about making it work, period ("Plaese! I must have tomorrow or will fired!"). Sometimes raising awareness of security is all you can do.

So, no, a multi-query injection attack is not likely to succeed in PHP for the reasons you stated. But it does make for a pretty good primer into the topic

Source Link
Machavity Mod
  • 31.6k
  • 38
  • 283
  • 382

I think you miss the point of Bobby Tables. The idea is to introduce the concept of SQL injection. The problem is that SQL injection, from a practical standpoint, is hard to give an example that is one-size-fits-all. It depends a lot on how you set your tables up, the data being held, how you're writing your queries, and what you do with the data after you pull it.

The real trick here is to get people to think about security at all. Like Shog said, most of the questions on SO are about making it work, period ("Plaese! I must have tomorrow or will fired!"). Sometimes raising awareness of security is all you can do.

So, no, a multi-query injection attack is not likely to succeed in PHP for the reasons you stated. But it does make for a pretty good primer into the topic