[Full-disclosure] When standards attack...
fw at deneb.enyo.de
Fri Mar 21 11:01:26 GMT 2008
* H. D. Moore:
> The WebKit folks just added client-side SQL database support:
> In addition to all of the existing attacks through a web browser, we can
> now take into account SQLite vulnerabilities and client-side SQL
> injection issues as well.
Interesting. SQLite is a great piece of software, but it's not very
close to SQL, viz:
sqlite> SELECT 1 = '1';
I wonder how the WebKit folks will bridge this gap, or if the people
behind HTML5 will standardize on whatever SQLite implements.
to write their programs in continuation-passing style, without much
syntactic support from the language. It's like pre-generics Java
typing, but this time for flow control constructs. Oh well.
> ...because letting developers choose to bind their query parameters has
> worked so well before ;-)
What's the alternative? A combinator library? A language extension
that only permits static query strings? String interpolation as
structured objects? Most approaches require a new Ecmascript revision.
Full-Disclosure is hosted and sponsored by Secunia.