string concatenation and prepared statements....

[mookalovesgloop]

i've been up to my eyeballs trying to self-teach and get a working knowledge of SQL, but what google and my "workbook" seem to be silent on is are there any known weaknesses/ways to bypass a sql prepared statement? i'm kind of leery about doing extensive google searching on touchy topics, so if anyone here can point me to where i can learn more about this i would sooooo appreciate it thanks

peace and blessings!
mooka

[WallShadow]

Install TOR, start it up, and then go through another proxy. It's completely secure against anyone but the most determined hacker. If you are terribly paranoid about this, also use your local coffee shop to do this.

As for sql weaknesses, the main one is sql injection.

LINKS!

decent generalized guide to introduce you to what it is and how it is done:
http://www.unixwiz.net/techtips/sql-injection.html

simple guide from owasp about what it is and how to prevent it:
https://www.owasp.org/index.php/SQL_injection

useful cheat sheet on sql injection that I've used on multiple occasions: (I'd be careful going to the site though)
http://ha.ckers.org/sqlinjection/

-WallShadow <3

[mookalovesgloop]

wow....thank you so, so much!!
peace
mooka!

[LoGiCaL__]

Before you go diving right into the sql injections I'd recommend taking the time to actually learn sql to the point where you feel comfortable writing queries with joins, unions, sub queries, then when you look into sql injections it will actually make some more sense as to what you are doing.

[mookalovesgloop]

Before you go diving right into the sql injections I'd recommend taking the time to actually learn sql to the point where you feel comfortable writing queries with joins, unions, sub queries, then when you look into sql injections it will actually make some more sense as to what you are doing.

yeah i definitely see that i'm gonna have to take baby steps with this... i want a real working knowledge of the language itself it seems like the best one to learn...i think...i mean it seems that sql's the most "universal" language in that it can be used on any type of database and yadda yadda yadda but i'm taking a sort of hegelian approach...the mainstream avenues are only gonna show you one side of the equation...i want to know how to code a rock-solid string, but i wanna know how to crack a rock solid string too, you know? and it's not always as simple as doing the opposite or inverse of the usual method....

i'm rambling lol anyway what i'm TRYING to say LoGiCaL__ is that i won't try to do things half-assed or cheaply--not my m.o.!!
peace and blessings!
mooka