24May05 MySQL links and security tip
I’ve started doing some work on MySQL again and needed to have an easily accessible reference to some of the documentation. The reference manual, numeric types, date and time types, string types
I also came across this tip with regards to MySQL security and something to keep in mind when dealing with authenticaing users.
For instance, suppose a user keys in the value for USERNAME as
##” and for PASSWORD, he keys in anything. Because MySQL interprets the character “##” as a comment, the query is terminated when the “##” character is found and there definitely will be a record matching just the username. The query thus returns a record and allows this user to login. Always be sure to check whether the username contatins a character like “##” and throw an appropriate error before even sending it to the database. questionable query:
SELECT 1 FROM <USERTABLE> WHERE USERNAME="<USERNAME>" AND USERPASSWORD="<USERPASSWORD>"
Comments are closed.