You could have a SQL library that defaults to inserting "OR 1=1" to every update... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

robertlagrant 63 days ago | parent | context | favorite | on: Stop Using JWTs

You could have a SQL library that defaults to inserting "OR 1=1" to every update query, which the SQL standard allows. I would blame the library.

inigyou 63 days ago [–]

The SQL library is meant to run the query you give it.

robertlagrant 56 days ago | [–]

But then "meant to" is doing the heavy lifting here. You could (and should) say that a JWT library is meant to default to secure.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact