Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder1.news.weretis.net!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Sylvia Else <sylvia@not.at.this.address>
Newsgroups: comp.misc
Subject: Re: Is computer security culture simply broken?
Date: Wed, 28 May 2014 15:25:23 +1000
Lines: 21
Message-ID: <bulaa5F2cq8U1@mid.individual.net>
References: <llqudr$rrm$1@solani.org> <86edncYTnbtS2RzOnZ2dnUVZ_t2dnZ2d@earthlink.com> <lls57i$ef3$1@dont-email.me> <budlfvFdpuvU1@mid.individual.net> <llsu37$u2v$4@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Trace: individual.net x9EDVFAJHMGLqWLM0CVvkABaWE1QHU2m/nD7Enp8cP8GUP7ZVU
Cancel-Lock: sha1:3Zq1hV3PlN6+ZQtAha7GbehU3QY=
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
In-Reply-To: <llsu37$u2v$4@dont-email.me>
Xref: csiph.com comp.misc:3309

On 26/05/2014 12:18 AM, Rich wrote:

> Time pressure may be a big influence.  It is also easy to do a plain
> text password:
>
>    select 1 from users where id = 'joe' and password = 'frank';
>
> Granted, one should use parameters rather than sql injection ready
> code, but the above is easy to code, esp. while the system is still
> running on the developers workstation only.  And it works, or at least
> appears to work, from the point of view of the testing folks.  So no
> one notices.

Perhaps we should just remove literals from SQL altogether. Yes, there 
are many places where a literal makes sense, but since programmers 
cannot be trusted to use them safely, let's rip them out. Programmers 
will have to learn how to use parameters. Some would probably be 
surprised to learn that parameters even exist.

Sylvia.