String interpolation: Difference between revisions

Revision as of 03:55, 4 October 2013

Revision as of 14:58, 14 October 2013

Line 155:

</source>

== Security Issuesissues ==

String Interpolation, like string concatenation, may lead to security problems. When failed to properly escape or filter user input data, system will expose to [[SQL Injectioninjection]], [[Scriptscript Injectioninjection]], [[XML External Entity Injection]] (XXE), and [[Cross Sitecross-site Scriptingscripting]] (XSS) attacks.<ref>http://google-caja.googlecode.com/svn/changes/mikesamuel/string-interpolation-29-Jan-2008/trunk/src/js/com/google/caja/interp/index.html#-autogen-id-1</ref>

An example of SQL Injectioninjection will be like this:

query = "SELECT x, y, z FROM Table WHERE id='$id' "

<source lang="text">

query = "SELECT x, y, z FROM Table WHERE id='$id' "

</source>

If ''$id'' is replaced with ''"'; DELETE FROM Table; SELECT * FROM Table WHERE id='"'', executing this query will wipe out all the data in Table.