[Catalyst] {OT] protecting against attacks with multilingual input

[Daniel McBrearty]

thanks people, this is very helpful. Well, everything is postgresql /
linux, so MSSQL will never be an issue.

Also I only ever use utf8 ... so I guess I'm home and dry. It would be
very neat to be able to do this without locale-switching (and
installing).

as a matter of interest, does anyone have a reference on why
placeholders protect against injection attacks ? If that is the case,
maybe I can even leave out \w filtering where that is appropriate to
do that.

thanks!

D

On 12/5/06, Brandon Black <blblack at gmail.com> wrote:
> On 12/5/06, Daniel McBrearty <danielmcbrearty at gmail.com> wrote:
>
> > This is what I'm talking about. I don't know this technique - I
> > thought the only approach was to filter input. I'm using DBIx, AFAIK
> > it does use placeholders ... ? If so, I can just take input, do some
> > basic "sanity" filtering, and store?
> >
>
> Yes, DBIC does use placeholders in most situations.  However, the
> NoBindVars-based Storage classes do not.  This includes the notable
> example of MSSQL via DBD::Sybase, which uses NoBindVars to work around
> issues with FreeTDS and/or DBD::Sybase.  The only really good way to
> fix this is to fix the DBD's or underlying DB libraries to properly
> support bind variables in all cases.
>
> > Phaylon : sure. A simple example would be, say, a multilingual web
> > forum. A text field would have a size limit, but other than that most
> > any utf8 character could be input.
>
> If your encoding is utf-8, you'll read in the perl i18n/l10n docs that
> UTF-8 has universal definitions for \w, \W, etc.  Thus you don't
> really even need to know the language to safely validate for word vs
> non-word chars, just the encoding.
>
> -- Brandon
>
> _______________________________________________
> List: Catalyst at lists.rawmode.org
> Listinfo: http://lists.rawmode.org/mailman/listinfo/catalyst
> Searchable archive: http://www.mail-archive.com/catalyst@lists.rawmode.org/
> Dev site: http://dev.catalyst.perl.org/
>


-- 
Daniel McBrearty
email : danielmcbrearty at gmail.com
www.engoi.com : the multi - language vocab trainer
BTW : 0873928131