Talk:Code injection

message: Such as regexps, and other ways to clean lint out of the expressions.
e.g. /s/[&|<>]//g  —Preceding unsigned comment added by 86.146.17.45 (talk) 14:16, 11 November 2009 (UTC)
thread_title:  Introduce ways to clean code injection 

message: This could be a very interesting article and I have already learned a lot from it, but it needs attention:
* A little more background could be set; the article could be confusing for people not familiar with the subject (though that said, you're unlikely to stumble on this article.)
* There seems to be a little overuse of bold/italics here and their use is not consistent.  Sometimes bold is used and sometimes italics are used.
* More expansion to the "HTML/Script Injection" section?
I'll do what I can later since this looks a very promising article. --82.18.240.96 21:01, 3 January 2006 (UTC)
replies: text: I'd love to help on this article, since it is very much related to Buffer overflow and Shellcode, which I have done alot of work on. Anyone else on board? -- Tompsci 17:54, 11 January 2006 (UTC)
thread_title:  Cleanup! 

message: I wanted to make some improvements to the introductory definition, which read -
Code injection is the exploitation of a computer bug that is caused by processing invalid data. Code injection can be used by an attacker to introduce (or "inject") code into a computer program to change the course of execution.
It's very odd to say "inject code into a computer program" which is very much not what happens with code injection in any case exemplified or any case where I've heard the term used, as the code is not injected into a program but into a _process_, indeed the introduced code is inside data and is injected into the data segment.
Is anyone aware of a case where code itself within a process actually gets modified by an attack as then the term code injection would then very clearly fit the bill?
I had a go at improving it, but I'm concerned that it's now a bit long. What do you think?CecilWard (talk) 23:26, 25 January 2009 (UTC)
thread_title:  Suggested improvement for intro and definition 

message: Would like to know whats the difference between 
Throw away bad characters
and 
Filter out known bads-- seems to be the same thing. 
Interestingly, 
"Throw away bad characters" is termed as practical and widely used and the "Filter out known bads" is termed as the worst form of defence.
Maybe I am ignorant and don't get it - can somebody please explain?
:I think you're right, so I removed it. 131.211.81.206 09:15, 6 April 2006 (UTC)
replies: text: The world "filter" seems to be inconsistently used among all the sites I've seen, usually to mean "sanitize non-destructively" but sometimes to mean "strip out".  I think it would be helpful to disambiguate in the article 64.171.57.66 22:41, 18 April 2006 (UTC)

text: I moved the entire section of secure input / output management to a new page, so the subjects could be expanded and clarified. I agree to 100% that the same thing was presented twice :-) --Blaufish 18:45, 3 May 2006 (UTC)

text: Throwing away and filtering are the same thing.  HOWEVER  Filtering and escaping are totally different,  and they are both common methods with dealing with code injection.  —Preceding unsigned comment added by 24.121.216.47 (talk) 06:15, 1 February 2008 (UTC)
thread_title:  Whats the difference? 

message: The developer thought this would ensure that only blue.php and red.php could be loaded. But as anyone can easily insert arbitrary values in COLOR...
How could anyone insert arbitrary values in COLOR given a non-editable drop-down list or listbox as the only means of input? --208.138.31.76 (talk) 20:00, 25 January 2008 (UTC)
replies: text: wow dude you don't have a clue,  do you even write code!?    The HTML drop down table is just for the client! You can send any string you want as $_GET, $_POST, $_COOKIE, $_FILE and most $_SERVER super globals.  —Preceding unsigned comment added by 24.121.216.47 (talk) 06:18, 1 February 2008 (UTC)
replies: text: PHP is not my area of expertise (nor is HTML), that is all. I didn't think of bypassing the UI. In other words, yes I had no clue.;-) --208.138.31.76 (talk) 18:51, 18 February 2008 (UTC)
thread_title:  Include file injection example - how is it possible? 

message: The end of the article section "Notable code injection programs" is turning into a link farm - if we're going to include some notable programs, we should be sure that they are notable. Perhaps only including programs that have wiki-articles is an easy way of control. AliveFreeHappy (talk) 19:09, 15 April 2009 (UTC)
thread_title:  Link farm 

message: I know this is kinda small, but I think it's stupid to put quotes around the word guestbook. First off, most people know what a guestbook is, I think, and putting quotes around it would be like putting quotes around any other random word. It would be like if I had something called a "Web server" and every time I said "Web server" I put quotes around it. I don't think it's appropriate in this context. Also, wikipedia itself says guestbook is one word: http://en.wikipedia.org/wiki/Guestbook which is how i've always seen it, so putting it as two words, and even midsentence capitalizing the word "Guest" seems wrong grammatically. I'm going to change this, and if anyone has strong reason why this page from wikipedia's "Web server" should have it the way it was when I saw it, I guess change it back. 74.203.78.67 (talk) 14:23, 29 July 2009 (UTC)
thread_title:  "Guest book" 

message: I'm surprised that the "code injection" technique of using the Win32 APIs CreateRemoteThread(), VirtualAllocEx(), and WriteProcessMemory() to inject code into a running process is not mentioned here.  Or that this sort of technique can be used benevolently to implement a debugger.  174.21.7.133 (talk) 01:57, 16 September 2009 (UTC)
thread_title:  Common Windows techniques 

message: Data sanitization redirects to this article. What does it mean? --Abdull (talk) 20:36, 17 February 2010 (UTC)
replies: text: Data sanitization is when you parse the inputs into the program and manipulate them to remove unwanted or uncessary data. It's the main way of protecting against Code Injection. So I guess it makes sense to redirect it here. 222.152.239.223 (talk) 06:04, 5 January 2011 (UTC)

text: That's what i think it means, but i cannot find a definition! --129.13.72.196 (talk) 11:22, 30 July 2015 (UTC)
thread_title:  Data sanitization? 

message: It seems wrong to define code injection only as "the exploitation of a computer bug that is caused by processing invalid data". See "Injecting Code Dynamically with the Debugging API" http://msdn.microsoft.com/en-us/library/bb384380.aspx in the .NET framework for an example of legitimate use.  — Preceding unsigned comment added by 188.26.163.110 (talk) 01:05, 8 December 2011 (UTC)
thread_title:  Dubious definition and legitimate uses 

message: This article needs a reference to Bobby Tables.  But I don't know where to put it. Jordan Brown (talk) 18:33, 23 May 2017 (UTC)
replies: text: Could be put in the line UserID: ';DROP TABLE User;order by --'UserID: 'Robert;DROP TABLE User;order by --'QuentinUK (talk) 14:56, 10 December 2018 (UTC)
thread_title:  Bobby Tables 

message: Hello fellow Wikipedians,
I have just modified 3 external links on Code injection. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20041010124514/http://www.codeproject.com/threads/winspy.asp to http://www.codeproject.com/threads/winspy.asp
*Added archive https://web.archive.org/web/20060209035745/http://www.codeproject.com/system/inject2exe.asp to http://www.codeproject.com/system/inject2exe.asp
*Added archive https://web.archive.org/web/20070410133521/http://www.codeproject.com/system/inject2it.asp to http://www.codeproject.com/system/inject2it.asp
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 04:50, 10 August 2017 (UTC)
thread_title:  External links modified 

message: I don't feel knowledgable enough to modify this but I want to report a couple of problems:
In the External Links section:
Article "Defending against Injection Attacks through Context-Sensitive String Evaluation (CSSE)" by Tadeusz Pietraszek and Chris Vanden Berghe
This link fails because http://chris.vandenberghe.org is no longer valid. I searched for this article in other places but failed to find a valid link to it. I don't want to just delete it because it sounds like a useful article if it can be found.
IMO
The Daily WTF regularly reports real-world incidences of susceptibility to code injection in software. 
This link doesn't provde a wide range of code injection incidences and should be deleted.  It seems to specialize in SQL code injection.
Rjapenga (talk) 15:58, 30 October 2017 (UTC)
thread_title:  Bad links 

message: Hello fellow Wikipedians,
I have just modified 2 external links on Code injection. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20100729023112/http://www.public.asu.edu/~rsriniv8/Documents/srini-das.pdf to http://www.public.asu.edu/~rsriniv8/Documents/srini-das.pdf
*Added archive https://web.archive.org/web/20050924080540/http://www.emsisoft.com/en/kb/articles/news041104/ to http://www.emsisoft.com/en/kb/articles/news041104/
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 20:04, 20 December 2017 (UTC)
thread_title:  External links modified 

message: ❛More and more mocking tools now use code injection to solve the problem of replacing static and non virtual members. Programming language will probably evolve to generate mocking-compatible bytecode. One direction will be to restrict the usage of non virtual members, the other one will be to generate, at least in test situations, a bytecode allowing non-inheritance based mocking.❜Dependency_inversion_principleQuentinUK (talk) 14:59, 10 December 2018 (UTC)
thread_title:  Programming  languages evolving to make code injection easier