The Daily WTF: Curious Perversions in Information Technology
Welcome to TDWTF Forums Sign in | Join | Help
in Search

People need to learn to sanitize SQL...

Last post 11-04-2008 2:43 AM by ac_1. 11 replies.
Page 1 of 1 (12 items)
Sort Posts: Previous Next
  • 11-03-2008 1:50 PM

    • Ashyre
    • Not Ranked
    • Joined on 07-01-2008
    • Posts 2

    People need to learn to sanitize SQL...

     

    Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

    [Microsoft][ODBC SQL Server Driver][SQL Server]Incorrect syntax near the keyword 'AND'.

    /voters/vtr_process.asp, line 94

     

    /Sigh. 

     

    From:


    http://www.shapethefuture.org/voters/voter_status.asp

  • 11-03-2008 2:38 PM In reply to

    • jpaull
    • Top 500 Contributor
    • Joined on 08-17-2007
    • Bristol, CT
    • Posts 58

    Re: People need to learn to sanitize SQL...

    I won't say it is the "Real" WTF... but Classic ASP??? For a website centered around the 2008 Election???

    C'mon, people!!!

  • 11-03-2008 2:42 PM In reply to

    Re: People need to learn to sanitize SQL...

    Sanitize?  No.  Simply use parameters?  Yes.
    I did not become a TDWTF forum moderator to make friends. And by the way, I haven't.
  • 11-03-2008 3:01 PM In reply to

    Re: People need to learn to sanitize SQL...

    jpaull:

    I won't say it is the "Real" WTF... but Classic ASP??? For a website centered around the 2008 Election???

    C'mon, people!!!

     

    I love this kind of comment.  If you don't upgrade an existing app that is built on an "outdated" technology, you get comments like this one.  If you do update it because it's on an "outdated" technology, you get "WTF??? Why update when the existing app is working fine."

    "You can call me anything you want, just don't call me late for dinner" "Or penis-butt."
  • 11-03-2008 3:06 PM In reply to

    • jpaull
    • Top 500 Contributor
    • Joined on 08-17-2007
    • Bristol, CT
    • Posts 58

    Re: People need to learn to sanitize SQL...

    campkev:

    jpaull:

    I won't say it is the "Real" WTF... but Classic ASP??? For a website centered around the 2008 Election???

    C'mon, people!!!

     

    I love this kind of comment.  If you don't upgrade an existing app that is built on an "outdated" technology, you get comments like this one.  If you do update it because it's on an "outdated" technology, you get "WTF??? Why update when the existing app is working fine."

     

    Point taken.... However, the existing app apparently does NOT work fine and appears to be using embedded SQL, which by itself should warrant a re-write.

  • 11-03-2008 3:20 PM In reply to

    Re: People need to learn to sanitize SQL...

    jpaull:

    campkev:

    jpaull:

    I won't say it is the "Real" WTF... but Classic ASP??? For a website centered around the 2008 Election???

    C'mon, people!!!

     

    I love this kind of comment.  If you don't upgrade an existing app that is built on an "outdated" technology, you get comments like this one.  If you do update it because it's on an "outdated" technology, you get "WTF??? Why update when the existing app is working fine."

     

    Point taken.... However, the existing app apparently does NOT work fine and appears to be using embedded SQL, which by itself should warrant a re-write.

    None of which has anything to do with it being written in Classic ASP

    "You can call me anything you want, just don't call me late for dinner" "Or penis-butt."
  • 11-03-2008 3:25 PM In reply to

    Re: People need to learn to sanitize SQL...

    Oh this one is gonna be wide open in 30 minutes.

    A zip code of ';-- reveals:

     

    Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

    [Microsoft][ODBC SQL Server Driver][SQL Server]Unclosed quotation mark after the character string ';-- AND AddrNum = AND BIRTHDATE = ''.

    /voters/vtr_process.asp, line 9

     

     

    I'm sure they're running as SA too. That box is toast.

  • 11-03-2008 3:59 PM In reply to

    Re: People need to learn to sanitize SQL...

    Might be worth removing the URL while they still have a database?

    Or am I just being too kind? :P

  • 11-03-2008 4:29 PM In reply to

    • arty
    • Top 200 Contributor
    • Joined on 01-09-2007
    • Posts 163

    Re: People need to learn to sanitize SQL...

    fyjham:

    Might be worth removing the URL while they still have a database?

    Or am I just being too kind? :P

    Since it's for voter registration, I'd hope everone waits til late tomorrow to play :-)

    ``Code and Own a piece of an app that is exploding'' -- Non-WTF(?) Jobs Post
  • 11-03-2008 8:21 PM In reply to

    Re: People need to learn to sanitize SQL...

     Gee, I hope Bobby Tables doesn't visit that site...

  • 11-03-2008 9:08 PM In reply to

    Re: People need to learn to sanitize SQL...

    samanddeanus:

     Gee, I hope Bobby Tables doesn't visit that site...

    Shouldn't matter, unless Bobby's Zip code is "90210; DROP DATABASE voters; --"
  • 11-04-2008 2:43 AM In reply to

    • ac_1
    • Not Ranked
    • Joined on 11-04-2008
    • Posts 1

    Re: People need to learn to sanitize SQL...

     Actually, that's not the database name, and the user name they log in with indicates they probably didn't give it rights to drop any databases. I didn't have the heart to try though.

Page 1 of 1 (12 items)
Powered by Community Server (Non-Commercial Edition), by Telligent Systems