On: SQL Injection through HTTP Headers

[dangrossman]

Reddit.com's response headers:

    Cache-Control: no-cache
    Connection: keep-alive
    Content-Encoding: gzip
    Content-Length: 18170
    Content-Type: text/html; charset=UTF-8
    Date: Wed, 04 Apr 2012 04:50:39 GMT
    Pragma: no-cache
    Server: '; DROP TABLE servertypes; --
    Vary: Accept-Encoding

[jedberg → dangrossman]

I put that in as a joke years ago. I can't believe it's still there.

[masklinn → jedberg]

I'm sure somebody somewhere is actually using that to clean up a table in some sort of wonky proxy setup and will cry foul if that header is ever removed.

[banthar → jedberg]

I've tried to write a program (https://gist.github.com/392445) which would be affected by this. It seems it should be `'); DROP TABLE servertypes; --` to actually drop any tables. All I was able to get now is syntax error.

[dave1010uk → banthar]

I had the same idea: https://gist.github.com/913402

[dangrossman → dave1010uk]

That's not a valid syntax for INSERT in MySQL. When you use the VALUE or VALUES keyword, it must be followed by a set of parentheses.

[dangrossman → banthar]

This is a valid syntax for MySQL:

    INSERT INTO servertypes SET server = 'Apache'

[mkopinsky → dangrossman]

I recently learned about the INSERT SET syntax, and have started to use it across the board. Sooooo much more readable when column names and values are next to each other rather than separated. </offtopic>