From 5c23f52166cd5e2aa348ec9006bf137fd6bea7fb Mon Sep 17 00:00:00 2001 From: Vincent Deffontaines Date: Sun, 6 Jan 2013 17:52:43 +0000 Subject: [PATCH] Security notes about SQL injection. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1429560 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/mod/mod_authn_dbd.html.en | 12 ++++++------ docs/manual/mod/mod_authn_dbd.xml | 10 +++++----- docs/manual/mod/mod_authz_dbd.html.en | 14 +++++++++++++- docs/manual/mod/mod_authz_dbd.xml | 11 +++++++++++ 4 files changed, 35 insertions(+), 12 deletions(-) diff --git a/docs/manual/mod/mod_authn_dbd.html.en b/docs/manual/mod/mod_authn_dbd.html.en index c89cb1c342..996b2d1f87 100644 --- a/docs/manual/mod/mod_authn_dbd.html.en +++ b/docs/manual/mod/mod_authn_dbd.html.en @@ -141,11 +141,11 @@ configuration required in some web applications.

Preventing SQL injections

-

It depends on what DBD driver and backend you use. With most - drivers you don't have to do anything : the statement is prepared - by the database at startup, and user input is used only as data. - But you may need to untaint your input. At the time of writing, - the only driver that requires you to take care is FreeTDS.

+

Whether you need to care about SQL security depends on what DBD driver + and backend you use. With most drivers you don't have to do anything : + the statement is prepared by the database at startup, and user input is + used only as data. But you may need to untaint your input. At the time + of writing, the only driver that requires you to take care is FreeTDS.

Please read mod_dbd documentation for more information about security on this scope.

@@ -238,7 +238,7 @@ var comments_identifier = 'http://httpd.apache.org/docs/trunk/mod/mod_authn_dbd. } })(window, document); //-->