Prepared statements, mostly. You define the query using variables, turn that query into a language-dependent object, assign values to those variables, then execute the statement. The values will be passed verbatim, without any parsing.
Or, since we’re talking about a password, you could encode or encrypt it before inserting it into the query string. The fact that the website could be negatively affected by phrases in the cleartext password is very concerning.
Are they vulnerable though, if they already exclude it at the user input?
I yet have to learn SQL and is there a way to allow passwords with '); DROP TABLE… without being vulnerable to an injection?
nevermind i googled it, and there various ways to do so
This still smells though. Why is the raw, plain text password string getting anywhere near database queries in the first place?
I doubt it is. they probably have a WAF that blocks these strings though and didnt want to bother reconfiguring it
Prepared statements, mostly. You define the query using variables, turn that query into a language-dependent object, assign values to those variables, then execute the statement. The values will be passed verbatim, without any parsing.
Or, since we’re talking about a password, you could encode or encrypt it before inserting it into the query string. The fact that the website could be negatively affected by phrases in the cleartext password is very concerning.