[19303] in bugtraq
Re: Adcycle 0.78b Authentication
daemon@ATHENA.MIT.EDU (Kenneth van Grinsven)
Tue Feb 20 20:19:02 2001
Message-ID: <200102202020.f1KKK9A08411@localhost.localdomain>
Date: Tue, 20 Feb 2001 21:20:09 +0100
Reply-To: Kenneth van Grinsven <kenneth@VANGRINSVEN.COM>
From: Kenneth van Grinsven <kenneth@VANGRINSVEN.COM>
X-To: Dag-Erling Smorgrav <des@THINKSEC.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
> > Half-assed workaround. The correct fix is to modify the call to
> $dbh->prepare() as follows:
> > > $sth = $dbh->prepare("SELECT * FROM login WHERE pid='$mycookpid' &&
agent='$agent' ORDER BY stime DESC");
> > $sth = $dbh->prepare("SELECT * FROM login WHERE pid=" .
> $dbh->quote($mycookpid) .
> " && agent =" .
> $dbh->quote($agent) .
> " ORDER BY stime DESC");
Actually the safe way would be to:
$sth = $dbh->prepare("SELECT * FROM login WHERE pid = ? AND agent = ? ORDER BY
stime DESC");
$sth->execute($mycookpid, $agent);
By using placeholders, your scalars can contain anything you like, without
having malicious side effects.
Greetings,
Kenneth van Grinsven
