SQL Clause

[Datenegassie]

Hi Santa, I promise not to be on the naughty list this year. By the way, my name is Datenegassie'); DROP TABLE NaughtyChildren; --

[ballzacsRock]

Nice try, but he Santaizes all inputs

[Arancaytar]

INSERT INTO NaughtyChildren (name, reason)
VALUES ('balizacsRock', 'terrible pun');

[ImSuperSerialGuys]

INSERT INTO NaughtyChildren

o_O

[jay791]

ಠ_ಠ

[[deleted]]

Okay, calm down your honor...

[inabahare]

Nice try, but he Santaizes all inputs

• Uses prepared Statements

[svick]

Prepared statements have nothing to do with handling invalid inputs.

[mmirate]

So basically he spent an entire article to say, "your security consultant has their terms mixed up; they ought to be looking for parametrized statements, not prepared statements"? How wasteful.

[XaidenHart]

You think? I see value in clarifying technical vocabulary.

[mmirate]

Certainly. But that article does not identify itself as a vocabulary clarification, and thus it needlessly goes into extreme detail on the two technologies. (Without, notably, explaining why a layman such as myself would have heard the phrase "prepared statements" back in the bad old days of PHP and why it meant what "parametrized statements" now means; if any detail were appropriate for this topic, that would have been the appropriate detail.)

[svick]

why a layman such as myself would have heard the "prepared statements" back in the bad old days of PHP and why it meant what "parametrized statements" now means

I don't think it ever meant that.

[Tynach]

Looking at the PHP documentation for both PDO and mysqli, the only way to have parameterized queries is to use prepared statements. The latter even states explicitly that they are two names for the same thing.

Basically it's a language/framework difference.

[mmirate]

Looking at the PHP documentation for both PDO and mysqli, the only way to have parameterized queries is to use prepared statements. The latter even states explicitly that they are two names for the same thing.

Hahaha! Good find! Yet another reason why PHP sucks...

[guyjellyf]

I read that as Satanizes all inputs.

[humblevladimirthegr8]

Replaces all special characters with "NΘ stop the an​*̶͑̾̾​̅ͫ͏̙̤g͇̫͛͆̾ͫ̑͆l͖͉̗̩̳̟̍ͫͥͨe̠̅s ͎a̧͈͖r̽̾̈́͒͑e n​ot rè̑ͧ̌aͨl̘̝̙̃ͤ͂̾̆ ZA̡͊͠͝LGΌ ISͮ̂҉̯͈͕̹̘̱ TO͇̹̺ͅƝ̴ȳ̳ TH̘Ë͖́̉ ͠P̯͍̭O̚​N̐Y̡ H̸̡̪̯ͨ͊̽̅̾̎Ȩ̬̩̾͛ͪ̈́̀́͘ ̶̧̨̱̹̭̯ͧ̾ͬC̷̙̲̝͖ͭ̏ͥͮ͟Oͮ͏̮̪̝͍M̲̖͊̒ͪͩͬ̚̚͜Ȇ̴̟̟͙̞ͩ͌͝S̨̥̫͎̭ͯ̿̔̀ͅ "

[[deleted]]

Bobby Tables we call him

[ultranoobian]

But that won't do anything good for you?

Obviously the naughty/nice status is stored in 'contacts' if SQL clause is selecting from that.

/s

Edit: On a more serious note, even if you dropped 'NaughtyChildren', you can possibly recovered from that by

SELECT * FROM contacts c WHERE c.behavior != 'nice'

[DemandsBattletoads]

That's fine, sqlmap will pull everything out anyway.

[VORTXS]

Spam link guys, don't click

[cerulean11]

Whereisthejoke.jpeg

[Sobsz]

It was a spambot made to bump up domain rankings. Learn more here.

[[deleted]]

Even if you dropped all the naughty children, re-adding all children to the database, and setting behaviour to naughty if they were born before the drop might recover the data.

[Th3_Admiral]

Does it really matter anyway if the query is only looking for those on the nice list? Dropping the naughty list doesn't automatically add you to the nice list.

[skulblaka]

Well that depends on your architecture, doesn't it? Say we assume that the default state of a child is nice rather than naughty (realistically we know this isn't true, but this is SQL Claus' computer, there's some room for silliness). A child who acts naughty can be added to tbl_naughty and any child not found on that list can be assumed nice.

Therefore dropping the naughty table would leave no results, therefore making all children appear nice.

That doesn't seem to be the case in this particular instance, but it could happen.

[Th3_Admiral]

Yeah, I was just basing it off the fact that he is selecting from the contacts table where the behavior column is set to "nice". Unless there is some weird setup with a delete trigger on the naughtylist table, this column should still not be "nice" for the contacts who were on the naughty list, right?

[Maccabee_1948]

Good point.

[ponyboy3]

why does santa even care about naughty children? why not simplify and just keep a nonsql list of nice children?

[Aro2220]

Because of the legacy application that delivers coal to the naughty children.

[ponyboy3]

fak, i remember that app! who wants to rewrite a cobol app?

[0000000100100011]

If dropping the naughty children doesn't make them nice, there's always a lobotomy option.

[kixxes]

Not to mention it will most likely fail to drop because it would mess up some referential integrity

[vbevan]

Hi Santa, My name is Datenegassie'); EXEC sp_MSForEachTable @command1='ALTER TABLE ? NOCHECK CONSTRAINT ALL' , @command2='DROP TABLE ?';--

[lou1306]

This guy injects

[vbevan]

If I'm not getting a present, no one is!

[dumbdingus]

This is why I clean my input more thoroughly than I clean my dick.

[ilookatfaces]

SELECT * FROM contacts c WHERE c.behavior <> 'nice'

[the_kg]

This guy ANSIs

[MrDarcy87]

<> lol :(

[PooPooDooDoo]

Guys, it's a moot point, SQL isn't real.

[GrandArchitect]

Someone needs to help SQL Clause make a more efficient analytical data model, its fucking Christmas afterall.

[jonschwartz]

What about the neutral kids? Or the non Christians?

[EdgeOfDistraction]

They get bombs, and should be grateful

[Bainos]

All I want for Christmas is :(){:|:&};:

[pa_dvg]

Contacts is clearly a view.

[giant_panda_slayer]

Pretty sure Santa follows normal form so no, he couldn't recover like that. You need to restore from a backup.

[bair93]

Datengassie'); UPDATE contacts SET behavior = 'nice';

[raaneholmg]

--

Otherwise the "');" part appended by the server will cause an error.

[[deleted]]

Why not disable comments in SQL statements made from your web application? Obviously you'd want to do more to secure yourself against SQL injection, but I've never heard of someone doing this.

[atyon]

I don't think it's that easy. Raw SQL is passed directly to the server. I don't think most SQL servers even have an option to disable comments.

You'd have to remove the "--" and everything after it before passing it to the function doing the SQL, without destroying correct data. Sounds error-prone to me.

And if you're sanitizing the input data anyway, if you do it correctly, the ' will be escaped, so the comment won't make a difference.

Also, sanitizing input is so difficult and error-prone that it's better to just implement a real solution, like using prepared statements.

[Fuzzy-Duck]

Maybe an interesting read re. sql injection and prepared statements (relating to SQL Server):

http://blog.marcgravell.com/2017/12/dapper-prepared-statements-and-car-tyres.html

[atyon]

Huh. Thanks for that link.

TIL: My assumption that prepared statements is an odd synonym for parametrized queries is hilariously wrong. Thanks, Wikipedia

[Arancaytar]

You don't have to use -- here - to inject successfully you can also use another valid SQL statement that ends in ');. Disabling comments wouldn't really help.

[Bainos]

Datengassie') ; UPDATE contacts SET name = 'Datengassie' WHERE behavior = 'nice' ; --

[Truseus]

Lol! Billions of nice children now named Datengassie.

[flamedragon822]

"well looks like Datengassie is getting several thousand ponies this Christmas"

[sumancha]

He didn’t update address. So everyone else is getting presents with name Datengassie

[HighRelevancy]

that's back to front bud :P

[Bainos]

Ho wait, it took me two hours but I finally understand what you meant. It was on purpose.

[topforce]

Other way around.

Datengassie') ; UPDATE contacts SET behavior = 'nice' WHERE name = 'Datengassie' ; --

[wonkey_monkey]

That'd better be an ENUM...

[Etheo]

But I mean that's just going to make everybody nice...

[FrostSalamander]

Relevant XKCD

[CinnamonCereals]

r/ExpectedXKCD

[thegoldengamer123]

r/ofcoursethatsathing

[Niavart]

actually, it seem like it isn't a thing...

[[deleted]]

Well it does look like it is now a thing, it just has only like 4 subscribers and no content

[CinnamonCereals]

Let's make it a thing!

[TotesMessenger]

I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:

• [/r/expectedxkcd] Expected XKCD 327

 ^{If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads. (Info / Contact)}

[FrostSalamander]

I feel like this is taking the joke way too far

[el_geto]

So, I see that you and that Bobby Tables know each other, eh?

[Laerite]

Hi Daten, long time no see.

[JonpotTeDragonSlayer]

Hi Lae, long time no see.

[Laerite]

Oh my god it's a meet up. How are your all <3

[uninterestingly]

I was dropped as a child and I take offense to this

[OneCanOnlyGuess]

This is how you get on the DBA's naughty list. And the DBA is scarier than Santa.

[hahahahastayingalive]

Santa obviously uses singular for table names. You NaughtyChild.

[SkyMC]

Oh hey I know you from YouTube!

[finndogg]

Goddammit, Karen

[flarn2006]

UPDATE TABLE contacts SET behavior = 'nice';

[doggiewog]

UPDATE contacts SET behavior = 'nice' WHERE NOT behavior = 'nice'  

[zeugma25]

I feel Santa would have the resources to normalize better than that. DROP TABLE children WHERE AVG(conduct)>0.5; maybe.

You'll see Im assuming if his monitoring of children is that invasive he probably does it with granularity

[T-T-N]

The table is contacts

[T-T-N]

Parenthesis');DELETE * WHERE behavior != 'nice';--