Comments on: Client-side SQL Injection Attacks http://www.gnucitizen.org/blog/client-side-sql-injection-attacks/ Information Security Think Tank Fri, 21 Nov 2008 19:40:42 +0000 http://wordpress.org/?v=2.6.3 By: anonymous http://www.gnucitizen.org/blog/client-side-sql-injection-attacks/#comment-122799 anonymous Thu, 03 Jul 2008 02:49:53 +0000 http://www.gnucitizen.org/blog/client-side-sql-injection-attacks#comment-122799 isnt there protection against that kind of attack? isnt there protection against that kind of attack?

]]> By: Google Gears: A bit unsafe? - Kartones Blog http://www.gnucitizen.org/blog/client-side-sql-injection-attacks/#comment-28284 Google Gears: A bit unsafe? - Kartones Blog Sun, 10 Jun 2007 22:00:41 +0000 http://www.gnucitizen.org/blog/client-side-sql-injection-attacks#comment-28284 [...] on the online side there are possible XSS flaws that could be exploited. SQL Injection was feared too, but seems that the Gears DB API uses blind [...] [...] on the online side there are possible XSS flaws that could be exploited. SQL Injection was feared too, but seems that the Gears DB API uses blind [...]

]]> By: name http://www.gnucitizen.org/blog/client-side-sql-injection-attacks/#comment-28093 name Sat, 09 Jun 2007 20:22:45 +0000 http://www.gnucitizen.org/blog/client-side-sql-injection-attacks#comment-28093 <blockquote>Even if your SQL queries are right but you trust the user input,</blockquote> why would anyone trust user input? (When attempting to avoid the obvious, of course)

Even if your SQL queries are right but you trust the user input,

why would anyone trust user input? (When attempting to avoid the obvious, of course)

]]> By: Aaron Boodman (Gears developer) http://www.gnucitizen.org/blog/client-side-sql-injection-attacks/#comment-27968 Aaron Boodman (Gears developer) Sat, 09 Jun 2007 01:37:18 +0000 http://www.gnucitizen.org/blog/client-side-sql-injection-attacks#comment-27968 You're right that Gears does open up more possibilities once a website has an XSS hole. Developers will have to treat the client database as suspect and validate it on the server, much the same way they validate other data coming from the client. You’re right that Gears does open up more possibilities once a website has an XSS hole. Developers will have to treat the client database as suspect and validate it on the server, much the same way they validate other data coming from the client.

]]> By: pdp http://www.gnucitizen.org/blog/client-side-sql-injection-attacks/#comment-27206 pdp Wed, 06 Jun 2007 18:58:42 +0000 http://www.gnucitizen.org/blog/client-side-sql-injection-attacks#comment-27206 Simon, you are right... the point is that it is still possible. Only the time will show. One thing that Googe Gears definitely promotes is persitent XSS. Even if your SQL queries are right but you trust the user input, you may end up saving JavaScript inside your database and then recalling it everytime the user does an action to retrieve that malicious entry. I know that the Firefox team is also working on a persistent storage for Firefox3 which is also based on SQLite. IE and Opera will follow. That will only increase the attack surface of attacks such as SQL Injection, XSS and CSRF. Simon, you are right… the point is that it is still possible. Only the time will show. One thing that Googe Gears definitely promotes is persitent XSS. Even if your SQL queries are right but you trust the user input, you may end up saving JavaScript inside your database and then recalling it everytime the user does an action to retrieve that malicious entry. I know that the Firefox team is also working on a persistent storage for Firefox3 which is also based on SQLite. IE and Opera will follow. That will only increase the attack surface of attacks such as SQL Injection, XSS and CSRF.

]]> By: Simon Willison http://www.gnucitizen.org/blog/client-side-sql-injection-attacks/#comment-26881 Simon Willison Tue, 05 Jun 2007 22:59:17 +0000 http://www.gnucitizen.org/blog/client-side-sql-injection-attacks#comment-26881 The Google Gears database API uses bind parameters which are immune to SQL injection. Developers could still write bad code, but Gears makes it easy enough to avoid SQL injection that only very poor developers are likely to end up with injection holes. The Google Gears database API uses bind parameters which are immune to SQL injection. Developers could still write bad code, but Gears makes it easy enough to avoid SQL injection that only very poor developers are likely to end up with injection holes.

]]>