Skip to content

Instantly share code, notes, and snippets.

@wrossmann
Created March 7, 2016 21:23
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save wrossmann/3f69532cdade2aa6c979 to your computer and use it in GitHub Desktop.
Save wrossmann/3f69532cdade2aa6c979 to your computer and use it in GitHub Desktop.
Ruby::Mysql2::bork
require 'mysql2'
my = Mysql2::Client.new(:host => 'localhost', :username => 'root', :database=>'test')
stmt = my.prepare('INSERT INTO user (salt, password) VALUES(?,?);')
salt = "1a7v95zj1xa1l26g80meeaplc7294dp"
hashed = "4542511a19a5b18fd6801653ddc97b6e6ef3e855f4736720d791c4f4eed78957c0b5906921725a3ad0d8e98cf6722243f64e552382a37eb839f204d4fe6770ae"
stmt.execute(salt, hash)
# woops, that should be 'hashed', not 'hash'.
# I sure hope a random integer doesn't find it's way into the 'password' column!
# Particularly not if it fails to raise even the most basic of notice!
# Inserted row: "1","1a7v95zj1xa1l26g80meeaplc7294dp","-2900714636270684210"
# oh noooooooooo...
CREATE TABLE `user` (
`id` INT(11) NOT NULL AUTO_INCREMENT,
`salt` VARCHAR(255) NOT NULL,
`password` VARCHAR(255) NOT NULL,
PRIMARY KEY (`id`)
);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment