<story><title>Tcl the misunderstood (2006)</title><url>http://antirez.com/articoli/tclmisunderstood.html?</url></story><parent_chain><item><author>stevoski</author><text>The phrase &quot;SQL Injection&quot; was coined in 2000. There was just about no understanding of the threat of these attacks in the 90s</text></item><item><author>RyanZAG</author><text>As others have said, most uses of Tcl was no doubt Eggdrop bots. I made an eggdrop bot to do some interesting stuff in an irc channel. I also learned nice and important lesson in the process about Tcl and dynamic execution in general (such as in SQL) : Fully dynamic execution is great as long as you spend more time checking input than actually writing logic.&lt;p&gt;As an example, you can do the following in Tcl as the article points out:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  set a pu
  set b ts
  $a$b &quot;Hello World&quot;
&lt;/code&gt;&lt;/pre&gt;
Awesome! I&apos;ll use this kind of dynamic behavior to let users of the bot have more freedom. Bzzzzt. This was back in the 90s and the idea of &apos;SQL injection&apos; wasn&apos;t as widespread as it is now... Getting around these kind of injections in Tcl requires constant vigilance and sometimes is very confusing.&lt;p&gt;Another interesting issue is the lack of types and how Tcl interprets them. Ask the user for a number and check if its between 1 and 3, and reject if it isn&apos;t. Works fine until the user tries the number 0x01, which matches 1 in some places but not in others. Gave me a lot of appreciation for typed languages where an int really is an int.</text></item></parent_chain><comment><author>btilly</author><text>In your circles they may have been &quot;just about no understanding&quot;, but in my circles there was.&lt;p&gt;For the record, the standard database interface that Perl uses, DBI, was first released as early alpha on Oct 12, 1994.  Its solution to SQL injection is bind parameters.  As far as I can tell, that first release had support for bind parameters, but I don&apos;t have that version&apos;s documentation for that feature.&lt;p&gt;The first release of the first real database driver was 24th Feb 1995.  (Again, early alpha, you couldn&apos;t actually fetch data.)  From the comments in the change log, bind variables were always a priority, and finally arrived for DBD::Oracle on 22 Aug 1995.  From that point on if you used Perl and connected using DBI in the way recommended by the documentation, you were protected from SQL injection attacks.</text></comment>
<story><title>Tcl the misunderstood (2006)</title><url>http://antirez.com/articoli/tclmisunderstood.html?</url></story><parent_chain><item><author>stevoski</author><text>The phrase &quot;SQL Injection&quot; was coined in 2000. There was just about no understanding of the threat of these attacks in the 90s</text></item><item><author>RyanZAG</author><text>As others have said, most uses of Tcl was no doubt Eggdrop bots. I made an eggdrop bot to do some interesting stuff in an irc channel. I also learned nice and important lesson in the process about Tcl and dynamic execution in general (such as in SQL) : Fully dynamic execution is great as long as you spend more time checking input than actually writing logic.&lt;p&gt;As an example, you can do the following in Tcl as the article points out:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  set a pu
  set b ts
  $a$b &quot;Hello World&quot;
&lt;/code&gt;&lt;/pre&gt;
Awesome! I&apos;ll use this kind of dynamic behavior to let users of the bot have more freedom. Bzzzzt. This was back in the 90s and the idea of &apos;SQL injection&apos; wasn&apos;t as widespread as it is now... Getting around these kind of injections in Tcl requires constant vigilance and sometimes is very confusing.&lt;p&gt;Another interesting issue is the lack of types and how Tcl interprets them. Ask the user for a number and check if its between 1 and 3, and reject if it isn&apos;t. Works fine until the user tries the number 0x01, which matches 1 in some places but not in others. Gave me a lot of appreciation for typed languages where an int really is an int.</text></item></parent_chain><comment><author>georgemcbay</author><text>As someone who spent his teenage years &quot;hacking&quot; in multiple senses of the word, I can assure you there were plenty of people using buffer overflows before rtm&apos;s worm and there were plenty of people using data injection attacks long before the phrase &quot;SQL Injection&quot; was coined.&lt;p&gt;Back before the mid-2000s it used to take years/decades for ideas like that to bubble up into being &quot;common wisdom&quot; but in those years/decades, there would be hundreds to thousands of people exploiting the ideas, sharing information with other like-minded individuals privately (pre-everyone-has-a-blog), etc.</text></comment>