Hacker News Reader

Did someone have a Bobby Tables moment?

In Oracle, you can't use a bind variable in setting a password on an account, so SQL injection is a more significant risk. I wrote some JavaScript and pl/sql to address that.

View on HN

I hope that javascript filter runs on the server and not on the web browser...

The php runs on the server, and does the same thing.

The JavaScript posts excessive status messages, and only allows a submit when all checks have passed.

Do you mean setting a database user account? As in the oracle user? Why is that exposed over the web?

There is/was a school of thought that each user should have their own database account, and the application should connect to the database as that user. The advantage being you can use the database's built-in user and role management and privileges instead of having to invent your own. I have admittedly not seen this done much, but there is a certain appeal to it.

I work for a company that is trying to bolt this functionality onto all the AWS database products. At least at the IAM role level.

As it stands now, no human can write to a DB in prod-- only service accounts.

Reply on news.ycombinator.com