Processing Web Forms Carefully
CGI applications are often used to search through some database. For example, a catalog might let you look for an item by color, or an on-line dating service might let you pick people by gender, location, age, and interests.
Sunday, September 15th, 2002
CGI applications are often used to search through some database. For example, a catalog might let you look for an item by color, or an on-line dating service might let you pick people by gender, location, age, and interests.
When the CGI application is in Perl, the database query is frequently performed using the DBI interface. This amazing product, the result of man-years of effort (coordinated by Tim Bunce), allows a Perl program to interact nearly identically with over a few dozen types of databases, including both commercial and open-source databases, and even “non-database” databases like a comma-separated-values (CSV) file. With DBI, the interaction between script and database is primarily in the form of a series of industry-standard SQL statements. And while common, I frequently see the transition from a CGI form element to a SQL query statement as a security risk.
For example, let’s say that the form field firstname accepts an SQL LIKE pattern (e.g., “Tom%”) for the first name of a person I’m searching for in my department. The Perl code to construct an SQL query using firstname as a parameter might look something like Figure One.
Figure One: Typical Perl code to construct an SQL query |
