[B! SQL] mad-pã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

mad-p id:mad-p

SQLã«é–¢ã™ã‚‹mad-pã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã‚‚ã‚Œã®è²¬ä»»ã‚’é–‹ç™ºä¼šç¤¾ã«å•ã†åˆ¤æ±º
ãƒã‚¤ãƒ³ãƒˆã¯ä¸‹è¨˜ã®é€šã‚Šã§ã™ã€‚ Xç¤¾ï¼ˆåŽŸå‘Šï¼‰ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã«ã¤ã„ã¦ç‰¹ã«æŒ‡ç¤ºã¯ã—ã¦ã„ãªã‹ã£ãŸ æå®³è³ å„Ÿã«ã¤ã„ã¦å€‹åˆ¥å¥‘ç´„ã«å®šã‚ã‚‹å¥‘ç´„é‡‘é¡ã®ç¯„å›²å†…ã¨ã™ã‚‹æå®³è³ å„Ÿè²¬ä»»åˆ¶é™ãŒã‚ã£ãŸ å½“åˆã‚·ã‚¹ãƒ†ãƒ ã¯ã‚«ãƒ¼ãƒ‰æ±ºæ¸ˆã‚’å¤–éƒ¨å§”è¨—ã—ç›´æŽ¥ã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’æ‰±ã£ã¦ã„ãªã‹ã£ãŸ Xç¤¾ãŒã€Œã‚«ãƒ¼ãƒ‰ä¼šç¤¾æ¯Žã®æ±ºæ¸ˆé‡‘é¡ã‚’çŸ¥ã‚ŠãŸã„ã€ã¨Yç¤¾ã«ä¾é ¼ã‚’ã—ã¦ã€ãã®çµæžœã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’ã„ã£ãŸã‚“DBã«ä¿å˜ã™ã‚‹ä»•æ§˜ã¨ãªã£ãŸï¼ˆ2010å¹´1æœˆ29æ—¥ï¼‰ Xç¤¾ã‹ã‚‰ã®å•ã„åˆã‚ã›ã«å¯¾ã—ã¦Yç¤¾ã¯ã€ã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’ä¿æŒã—ãªã„æ–¹å¼ã«å¤‰æ›´ã™ã‚‹ã“ã¨ãŒå¯èƒ½ã§ã€ãã®ã»ã†ãŒå®‰å…¨ã¨ãªã‚Šã€è²»ç”¨ã¯20ä¸‡å††ç¨‹åº¦ã§ã‚ã‚‹æ—¨ã‚’ä¼ãˆãŸï¼ˆ2010å¹´9æœˆ27æ—¥ï¼‰ãŒã€ãã®å¾ŒXç¤¾ã¯æ”¹è‰¯ã®æŒ‡ç¤ºã‚’ã—ãªã‹ã£ãŸ ä»¥ä¸‹ã®è„†å¼±æ€§ãã®ä»–ãŒèªã‚ã‚‰ã‚ŒãŸ ã‚·ã‚¹ãƒ†ãƒ ç®¡ç†æ©Ÿèƒ½ã®IDã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒ admin/password ã§ã‚ã£ãŸ å€‹äººæƒ…å ±ãŒè¨˜è¼‰ã•ã‚ŒãŸãŠå•ã„åˆã‚ã›ãƒã‚°ãƒ•ã‚¡ã‚¤ãƒ«ã®é–²è¦§ãŒå¯èƒ½ï¼ˆãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒªã‚¹ãƒ†ã‚£ãƒ³ã‚°ã¨æ„å›³ã—ãªã„ãƒ•ã‚¡ã‚¤
mad-p 2015/01/22
SQL

sqlã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³

security
ãƒªãƒ³ã‚¯
(DBD::)SQLiteã«ãŠã‘ã‚‹ORDER BYã®æœ€é©åŒ–ã¨æ¤œç´¢çµæžœã®ä¸¦ã³é †ã«ã¤ã„ã¦ - Charsbar::Note
æœ€åˆã«çµè«–ã‚’æ›¸ã„ã¦ãŠãã¾ã™ãŒã€ã“ã‚Œã¯æ£ã—ã„ä½¿ã„æ–¹ã‚’ã§ãã¦ã„ã‚‹æ–¹ãªã‚‰ã¾ã£ãŸãæ°—ã«ã™ã‚‹å¿…è¦ãŒãªã„è¨˜äº‹ã§ã™ã€‚è¦ã™ã‚‹ã«ã€ŒORDER BYã‚’æŒ‡å®šã—ã¦ã„ãªã„ã®ã«SELECTæ–‡ã®è¿”å€¤ã«ä¸€å®šã®ä¸¦ã³é †ã‚’æœŸå¾…ã™ã‚‹æ–¹ãŒé–“é•ã„ã€ã¨ã„ã†ã ã‘ã®è©±ãªã‚“ã§ã™ãŒã€å…ˆæ—¥ã®QA Hackathonã§æ½œåœ¨çš„ãªå•é¡ŒãŒå˜åœ¨ã—ã¦ã„ã‚‹ã“ã¨ãŒæµ®ãå½«ã‚Šã«ãªã£ãŸã®ã§ã€å¿µã®ãŸã‚å…±æœ‰ã—ã¦ãŠãã¾ã™ã€‚ ã•ã¦ã€SQLiteã¯2012å¹´12æœˆ12æ—¥ã«ãƒªãƒªãƒ¼ã‚¹ã•ã‚ŒãŸãƒãƒ¼ã‚¸ãƒ§ãƒ³3.7.15ã§ã‚¯ã‚¨ãƒªã‚ªãƒ—ãƒ†ã‚£ãƒžã‚¤ã‚¶ã‚’å¼·åŒ–ã—ã€ãã®çµæžœã€ORDER BYãŒã‚ˆã‚Šç©æ¥µçš„ã«æœ€é©åŒ–ã•ã‚Œã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã—ãŸã€‚ ãŸã ã€DBD::SQLiteã¯ã—ã°ã‚‰ããƒªãƒªãƒ¼ã‚¹ã‹ã‚‰é ã–ã‹ã£ã¦ã„ãŸãŸã‚ã€ã“ã®å¤‰æ›´ãŒPerlç•Œéšˆã®é–‹ç™ºè€…ã®ç›®ã«è§¦ã‚Œã‚‹ã‚ˆã†ã«ãªã£ãŸã®ã¯ã¤ã„æœ€è¿‘ã€2013å¹´4æœˆ4æ—¥ã«1.38_02ãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚ŒãŸã¨ãã®ã“ã¨ã§ã—ãŸã€‚ ã“ã®ã¨ãã©ã®ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã®ã©ã®ãƒ†ã‚¹ãƒˆãŒã“ã‘ã‚‹ã‚ˆã†ã«ãªã£ãŸã®ã‹ã¯ã¾ã
mad-p 2013/05/01
SQLiteã«ã¯reverse_unordered_selectsã¨ã„ã†ãƒ—ãƒ©ã‚°ãƒžãŒã‚ã‚‹ã€‚ãƒ†ã‚¹ãƒˆã§ã“ã‚Œã‚’ä½¿ã†ã¨ã€æš—é»™ã®ã†ã¡ã«SELECTæ–‡ã®çµæžœãŒä¸€å®šã®é †åºã§è¿”ã£ã¦ãã‚‹ã“ã¨ã«ä¾å˜ã—ã¦ã„ã‚‹ã‹ã‚ã‹ã‚‹ã€‚nrhd

sql

sqlite
ãƒªãƒ³ã‚¯
Rails SQL Injection Examples
Overview The Ruby on Rails web framework provides a library called ActiveRecord which provides an abstraction for accessing databases. This page lists many query methods and options in ActiveRecord which do not sanitize raw SQL arguments and are not intended to be called with unsafe user input. Careless use of these methods can open up code to SQL Injection exploits. The examples here do not inclu
mad-p 2013/03/28
ActiveRecordã«SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã™ã‚‹æ–¹æ³•ãƒªã‚¹ãƒˆã€‚ä¸‡èƒ½ã®å¯¾ç–ã¯ã§ããªã„ã®ã§ã‚¢ãƒ—ãƒªå€‹åˆ¥ã«è€ƒãˆã‚‹ã—ã‹ãªã„ã‹ãª

rails

SQL
ãƒªãƒ³ã‚¯
Ruby on Railsã®find_by_*ãƒ¡ã‚½ãƒƒãƒ‰ã«SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³è„†å¼±æ€§(CVE-2012-5664) | å¾³ä¸¸æµ©ã®æ—¥è¨˜
Ruby on Rails(3.2.9, 3.1.8, 3.0.17ä»¥å‰)ã®find_by_*ãƒ¡ã‚½ãƒƒãƒ‰ã«SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³è„†å¼±æ€§ãŒè¦‹ã¤ã‹ã‚Šã¾ã—ãŸ(CVE-2012-5664)ã€‚ã“ã®ã‚¨ãƒ³ãƒˆãƒªã§ã¯ãã®æ¦‚è¦ã¨å¯¾ç–ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ æ¦‚è¦ Ruby on Railsã®find_by_*ãƒ¡ã‚½ãƒƒãƒ‰ã®å¼•æ•°ã¨ã—ã¦ãƒãƒƒã‚·ãƒ¥ã‚’æŒ‡å®šã™ã‚‹ã“ã¨ã§ã€ä»»æ„ã®SELECTæ–‡ã‚’å®Ÿè¡Œã§ãã‚‹è„†å¼±æ€§ãŒã‚ã‚Šã¾ã™ã€‚ æ¤œè¨¼ Ruby on Rails3.2.9ã®ç’°å¢ƒã‚’ç”¨æ„ã—ã¦ã€ä»¥ä¸‹ã®2ã¤ã®ãƒ¢ãƒ‡ãƒ«ã‚’ç”¨æ„ã—ã¾ã—ãŸã€‚ $ rails g scaffold user name:string em ail:string $ rails g scaffold book author:string title:string ãƒ¢ãƒ‡ãƒ«Userã¯å€‹äººæƒ…å ±ã‚’ä¿æŒã—ã¦ãŠã‚Šã€è‡ªåˆ†è‡ªèº«ã®æƒ…å ±ã®ã¿ãŒé–²è¦§ã§ãã‚‹ã¨ã„ã†æƒ³å®šã§ã™ã€‚ãƒ¢ãƒ‡ãƒ«Bookã¯æ›¸èªŒãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã§ã‚
mad-p 2013/01/04
rails

SQL
ãƒªãƒ³ã‚¯
ORM is an anti-pattern | Seldo.com
I tweeted about ORM last week, and since then several people have asked me to clarify what I meant. I have actually previously written about ORM, but it was in the context of a larger discussion about SQL and I shouldn't have confused the two issues. So here I'm going to focus on ORM itself. I'm also going to try to be very brief, since it became very apparent from my SQL article that people tend
mad-p 2011/06/21
ORMã¯ã‚¢ãƒ³ãƒãƒ‘ã‚¿ãƒ¼ãƒ³ã¨ã„ã†è¨˜äº‹ã€‚æ•°æ—¥å‰ã«ç—›æ„Ÿã—ãŸã°ã‹ã‚Šã€‚ORMã§å•é¡Œã‚’é›£ã—ãã—ã¡ã‚ƒã£ãŸå¾Œã«æ³£ãã¤ã„ã¦ãã‚‹ã‹ã‚‰ã€ã¾ã™ã¾ã™é ç—›ã„ã€‚æœ€åˆã‹ã‚‰SQLã§æ›¸ã‘ã°ãšã£ã¨ã‚·ãƒ³ãƒ—ãƒ«ã§é€Ÿãã¦ãƒ‡ãƒƒãƒ‰ãƒãƒƒã‚¯ãƒ•ãƒªãƒ¼ã«æ›¸ã‘ã‚‹ã®ã«

ORM

SQL
ãƒªãƒ³ã‚¯
1