The information available

Discussion on:

High-profile New Zealand websites hacked

View entire thread

Message 2 of 1

Next » « Prev

0 Votes

+ -

honeymonster 21st Apr 2009

actually hints at an application-level
vulnerability. There's no SQL to inject at
either IIS nor Apache.

SQL injection vulnerabilities are most common
in PHP and old-style ASP (i.e. not ASP.NET)
applications. Especially PHP with variable
interpolation and an early culture of not
supporting parameters in db libraries is a
liability. So much so that several products
based upon made their vendors make the
top 10 list of most vulnerable vendors.

Both PHP and old-style ASP still makes it a
pain to use parameterized statements compared
to synthesized (and often vulnerable)
statements. Thus luring incompetent and
amateurish developers down the wrong path.