Text 569, 61 rader
Skriven 2004-09-13 18:11:22 av Antti Kurenniemi (1:379/45)
    Kommentar till text 568 av Ellen K. (1:379/45)
Ärende: Re: Spammers faster than the good guys....
==================================================
From: "Antti Kurenniemi" <NOantti@SPAManttikPLEASE.com>

"Ellen K." <72322.enno.esspeeayem.1016@compuserve.com> wrote in message
>>Noooooooooo! <g, but serious>   That input needs to *also* be checked at
>>the
>>receiving end, the end that checks wether the login is valid or not.
>>Because
>>if you trust only the login screen to limit the number of characters, I'll
>>crash it in .01 second by sniffing the packet the login screen sends, and
>>adding more characters to it. The server side should *never* trust input
>>being validated at the client side, never.
>
> Come on Antti, I didn't mean not to check whether the person has
> a valid login!!!

I didn't mean that, I just meant to say that any and all input needs to be
validated at the server end no matter how good checks are being done at the
client / middle tier.


>>We have a database system that does it the wrong way.[snip]
> This sounds completely bizarre.

Tell me about it.


> Anyway the setup you describe is not how a normal database
> application works.

...and don't I know it, my goodness - sometimes I daydream of being able to use
a real database, but nooooo, this is what I'm stuck with.


> First of all you don't send SQL from the users,

No SQL here.


> Secondly why are you changing the structure of a
> production database?!?

Sometimes we need to add a new field or change the size of an existing one.


> Finally, in an organization of any size you would have a
> four-tier setup where changes to the business logic
> would be handled in the middle tiers, never at the client.

Well, once we had a proper system that followed logic in how it works, but then
I woke up and had to go to work <g>. No, really, the thing sucks & blows at the
same time, but our new owners won't allow me to change anything. They have
their own system which they are going to start implementing next spring, and
for what I can tell it's at least as bad as the current one. Looks like I'll be
looking for a new job again next year
:-(


Antti Kurenniemi

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)