<story><title>Finding an authorization bypass on my own website</title><url>https://maxwelldulin.com/BlogPost?post=9185867776</url></story><parent_chain><item><author>PeterisP</author><text>The key point is that an abstraction layer trying to implement an API that looks like parametrized queries is not equivalent to actual parametrized queries where the query and parameters are kept separately, and the SQL text is parsed and execution plan is formed by the DB engine &lt;i&gt;before&lt;/i&gt; the parameters are even considered. If your DB library is inserting the parameters in a text query before sending it off to the server to be parsed as arbitrary SQL, that&amp;#x27;s not a parametrized query, but just fake smoke and mirrors.</text></item></parent_chain><comment><author>bgrainger</author><text>One major problem is that the MySQL &amp;quot;text&amp;quot; protocol doesn&amp;#x27;t support true parameterised queries. There&amp;#x27;s no way to pass parameters in the `COM_QUERY` packet: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;dev.mysql.com&amp;#x2F;doc&amp;#x2F;internals&amp;#x2F;en&amp;#x2F;com-query.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;dev.mysql.com&amp;#x2F;doc&amp;#x2F;internals&amp;#x2F;en&amp;#x2F;com-query.html&lt;/a&gt;&lt;p&gt;That&amp;#x27;s probably why many of the libraries mentioned in this thread use &amp;quot;smoke and mirrors&amp;quot;. Of course, it is quite possible to correctly escape a value by rendering it to a string first, _then_ encoding the whole thing.&lt;p&gt;To have true parameterised queries, you need to use the &amp;quot;binary&amp;quot; protocol, which many MySQL libraries don&amp;#x27;t offer support for. (MySQL also has some frustrating limitations with the binary protocol, such as not allowing a SQL string containing more than one statement to be prepared.)</text></comment>
<story><title>Finding an authorization bypass on my own website</title><url>https://maxwelldulin.com/BlogPost?post=9185867776</url></story><parent_chain><item><author>PeterisP</author><text>The key point is that an abstraction layer trying to implement an API that looks like parametrized queries is not equivalent to actual parametrized queries where the query and parameters are kept separately, and the SQL text is parsed and execution plan is formed by the DB engine &lt;i&gt;before&lt;/i&gt; the parameters are even considered. If your DB library is inserting the parameters in a text query before sending it off to the server to be parsed as arbitrary SQL, that&amp;#x27;s not a parametrized query, but just fake smoke and mirrors.</text></item></parent_chain><comment><author>tedunangst</author><text>From the mysqljs readme: &amp;quot;Caution This also differs from prepared statements in that all ? are replaced, even those contained in comments and strings.&amp;quot;&lt;p&gt;Eek. &amp;quot;select * from classes where teacher = &amp;#x27;?&amp;#x27;&amp;quot; -&amp;gt; boom.</text></comment>