Tagged #databases

If you've ever kept a spreadsheet of anything (customers, books you've read, expenses), you already understand most of what a database is. You've got rows, you've got columns, every row is one thing and every column is one fact about it. A relational database is that idea, made strict and fast and able to handle millions of rows without your laptop fan taking off. The strict part is the important difference. A spreadsheet lets you type "twelve" into a column that's supposed to hold numbers, leave half the cells blank, and spell the same customer's name three different ways. A database makes…

SQL injection is one of the oldest web vulnerabilities around, and it still turns up constantly. The reason is simple. The vulnerable version of the code is the most obvious way to write it. Picture a search box that looks up a user by email. The natural first attempt in PHP looks like this: It works. Type in an email, get a user back. The problem is that you've taken text from a stranger and pasted it directly into a command your database will run. The database has no way to tell which parts you wrote and which parts the visitor wrote. It just sees one string of SQL. So if someone types…