On Mon, 29 Sep 2008, bzhbfzj3001@xxxxxxxxxxxxxx wrote: > On Thu, 25 Sep 2008, lmfao@xxxxxxxxxxx wrote: > > > Are you kidding ? > > > > As the PHP manual said "if you use double quotes there will be a need to > > escape the variable names". > > > > In your example you use a function with double quotes, without escaping the > > variable $sort_by, so > > this is not a PHP vulnerability, but a development one. > > > > For this time, don't blame PHP, blame developers. > > It's like if I was using mysql_query() without escaping user's inputs...an > > sql injection, not a PHP vuln ;) > > > To be fair, this kind of api is obviously a disaster waiting to happen. > > Use an array to express an array of arguments? No, we'll just use concatenated > strings again, that never caused any problems with sql... I wonder why all > other languages have that strange 'prepared statements' format, and they never > get the sql injection bugs. It's unfair! you mean like pg_prepare and friends? http://us2.php.net/manual/en/function.pg-prepare.php > > Anyone up for a bet when PHP will add some more 'magic_quotes' to fix this > mistake? > ----------------------------------------- Mark E. Napier Director of Information Technology School of Library and Information Science Indiana University
