What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 128 Stack Exchange communities.

Is there a canonical SQL injection page that I can point people towards when they post a question with an SQL injection vulnerability? Is it polite to do this. Sometimes, I know it's just an example, and that it isn't real code so it's OK if it has SQL injection vulnerabilities. However, when it's a new user, with low rep asking a very simple question, I find it very hard not to try and teach them about the dangers of SQL Injection. Is there a specific Stackoverflow question I can point them to? Or is there some other page on the internet that better explains the problem. and can help them fix it.

share|improve this question
2  
Whenever you encounter somebody smoking a cigarette, do you also find it very hard not to try to teach them about the dangers of cigarette smoking? –  Gabe May 7 '11 at 4:04
4  
@Gabe: There's a big difference. If the smoke of the cigarette blown into the wrong direction could expose millions of banking accounts, then yes, I'd tell them that they should quit smoking. Smoking is more like Global Variables. –  Time Traveling Bobby May 9 '11 at 14:32
    
Does the question belong to SO? –  GrzegorzOledzki May 9 '11 at 16:16
    
I honestly think the SO engine could/should parse code snippets in PHP+mysql tagged questions and autolink to some canonical question if it contains both mysql_query and $_GET/ $_POST / $_REQUEST. –  therefromhere Feb 11 '12 at 0:42
add comment

8 Answers 8

Yes, xkcd's Little Bobby Tables is standard. It must be one of the most frequently linked pages at SO.

share|improve this answer
4  
While funny, it doesn't really get the point across to somebody who is not familiar with the problem. Also, it doesn't really explain how it can be fixed. –  Kibbee May 7 '11 at 1:35
4  
On the contrary, a light-weight version of "you are doing something really dumb" is much more effective. Somebody that can't take that hint (they made a cartoon about it!) and research this problem by himself cannot be helped. Link to a dup if you have to. –  Uphill Luge May 7 '11 at 1:57
    
Some people occasionally made it into a tag: meta.stackexchange.com/questions/32108/… –  Andrew Grimm May 9 '11 at 13:48
    
Don't forget to mention that this comic strip got his own homepage! –  Time Traveling Bobby May 9 '11 at 14:27
    
@Bobby: Are you named after Robert drop tables? –  Andrew Grimm May 9 '11 at 23:16
    
@Andrew Grimm: Not that I know of, but my name is Robert, though. –  Time Traveling Bobby May 10 '11 at 6:49
add comment

You could author the tag wiki page and point people towards that.

share|improve this answer
add comment

Why, uh, here's a nice answer to a sql injection question that you could link to. Over and over. Pretty please.

share|improve this answer
    
Interesting - the question had been viewed 7.5 Ktimes, but there was code that hadn't been highlighted. –  Andrew Grimm May 9 '11 at 13:53
    
@AndrewGrimm: All of the sql code is in code blocks. As for why it hasn't been colored properly I can't quite tell... brb sandbox. –  Won't May 9 '11 at 13:58
    
@Will - sorry, I was referring to one of the answers not having code highlighted. –  Andrew Grimm May 9 '11 at 13:59
    
@AndrewGrimm: Sql isn't getting prettified... meta.stackexchange.com/questions/90521/… –  Won't May 9 '11 at 14:05
    
There are quite a few [sql-injection] questions that don't have a language specified, so I just set the default highlighting on the tag to lang-sql. –  mmyers May 9 '11 at 14:28
    
@mmyers: Doesn't appear to be working for my incredibly awesome answer –  Won't May 9 '11 at 16:12
    
No? This is what I see. –  mmyers May 9 '11 at 16:14
    
@mmyers: I swear it wasn't doing it when I looked at it earlier. Perhaps cache? –  Won't May 9 '11 at 16:22
add comment

Point them to OWASP, they have good ressources that explains well the security problem, what to do and what not to do. It is one of the rare places that you are sure to find quality information about security problem.

Pages they have about SQL Injection :

SQL Injection
Guide to SQL Injection
SQL Injection Prevention Cheat Sheet
Reviewing Code for SQL Injection

share|improve this answer
add comment

I'm a fan of the Wikipedia page on SQL injection because it provides an adequate description of the problem, provides an overview of the solution, and lists notable hacks where it was a factor.

It's also rather long, so it might not actually be read.

share|improve this answer
3  
perhaps this is an argument for a canonical question/answer pair here that sumarrizes this information in a more scannable way? blog.stackoverflow.com/2011/01/… –  Jeff Atwood May 7 '11 at 2:10
add comment

Someone needs to do a rant on the subject equal to the Cthulhu answer on regular expressions and HTML.

share|improve this answer
add comment

This answer seems like a reasonable bet for PHP + MySQL, which I'd bet is the worst offender:

Best way to stop SQL Injection in PHP

I've just edited in a link to the bobby tables question to give context.

share|improve this answer
add comment

I learned about it at sqlzoo.net/hack.

share|improve this answer
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .