# DBI security tainting

- ## By default DBI ignores Perl tainting

  - doesn't taint database data returned ‘out’ of the DBI
  - doesn't check that parameters passed ‘in’ to the DBI are not tainted

- ## The TaintIn and TaintOut attributes enable those behaviours

  - If Perl itself is in taint mode.

- ## Each handle has it's own inherited tainting attributes

  - So can be enabled for particular connections and disabled for particular statements, for example:
  $dbh = DBI->connect(…, { Taint => 1 }); # enable TaintIn and TaintOut
  $sth = $dbh->prepare("select * from safe_table");
  $sth->{TaintOut} = 0; # don’t taint data from this statement handle

- ## Attribute metadata currently varies in degree of tainting

  $sth->{NAME}; — generally not tainted
  $dbh->get_info(…); — may be tainted if the item of info is fetched from database

## .

Previous slide | Next slide | Back to first slide | View graphic version