Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enabling multiple statements for mysql-async compatibility #102

Closed
thelindat opened this issue Mar 20, 2022 · 0 comments
Closed

Enabling multiple statements for mysql-async compatibility #102

thelindat opened this issue Mar 20, 2022 · 0 comments
Labels
documentation Improvements or additions to documentation

Comments

@thelindat
Copy link
Member

thelindat commented Mar 20, 2022

How to enable multiple statements (aka easy SQL injection)

Seriously, why do people feel the need to do this?
You can enable multiple statements to be executed by adding multipleStatements=true to your connection string.

This allow's SQL injection in resources that use string concatenation, such as esx_kashacter, rather than parameters, allowing clients to easily delete your entire database (see: https://forum.cfx.re/t/database-tables-are-deleted/4764756)


Enabling multi-statements allows resources to execute multiple queries in a single function, rather than splitting it into several; this is a common practice in encrypted resources that check for and create tables every time they start rather than providing users with an sql file to execute themselves (i.e. esx_job_creator).

It's also required when using vRP due to users love of multi-statements to call SELECT LAST_INSERT_ID, despite it already being returned by both query and insert functions.

image

@thelindat thelindat added the documentation Improvements or additions to documentation label Mar 20, 2022
@thelindat thelindat changed the title Multiple statements (mysql-async compatibility) Enabling multiple statements for mysql-async compatibility Mar 20, 2022
@thelindat thelindat pinned this issue Mar 20, 2022
@overextended overextended locked as resolved and limited conversation to collaborators Nov 14, 2022
@thelindat thelindat closed this as not planned Won't fix, can't repro, duplicate, stale Aug 8, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
documentation Improvements or additions to documentation
Projects
None yet
Development

No branches or pull requests

1 participant