We’re rewarding the question askers & reputations are being recalculated! Read more.
3 Copy edited. [(its = possessive, it's = "it is" or "it has". See for example <http://www.wikihow.com/Use-Its-and-It%27s>.)
source | link

Answer

does he just want people to stop using SQL/Relational Databases because of SQLi attacks?

The 'Bobby Tables' article seems to suggest that this, it and of itself is a reason to not use SQL:

The solution. The only solution. Is to eliminate SQL from the system entirely. If there is no SQL engine, then there can be no SQLi attacks.

He might have other reasons that he discusses elsewhere. II wouldn't know because I don't really read much of his stuff.

Digression

This part isn't really an answer, but I think the question of the value of SQL is far more interesting (as do others, apparently.)

I've had a lot of experience using SQL and I think I have a fair understanding of it'sits strengths and weaknesses. My personal feeling is that it's been overused and abused, but that the idea that we should never use it is kind of silly. The idea that we must choose 'SQL always' or 'SQL never' is a false dichotomy.

As far as SQL injection being an argument for not using SQL, that's laughable. This is a well understood problem with a pretty simple solution. The problem with this argument is that SQLi isn't the only vulnerability that exists. If you think that using JSON APIs makes you safe, you are in for a big surprise.

I think every developer should watch this video titled "Friday the 13th: Attacking JSON - Alvaro Muñoz & Oleksandr Mirosh - AppSecUSA 2017"

If you don't have the time or inclination to watch through it, here's the gist: A lot of JSON deserialization libslibraries have remote code execution vulnerabilities. If you are using XML, you have even more to worry about. Banning SQL from your architecture will not make your system secure.

Answer

does he just want people to stop using SQL/Relational Databases because of SQLi attacks?

The 'Bobby Tables' article seems to suggest that this, it and of itself is a reason to not use SQL:

The solution. The only solution. Is to eliminate SQL from the system entirely. If there is no SQL engine, then there can be no SQLi attacks.

He might have other reasons that he discusses elsewhere. I wouldn't know because I don't really read much of his stuff.

Digression

This part isn't really an answer but I think the question of the value of SQL is far more interesting (as do others, apparently.)

I've had a lot of experience using SQL and I think I have a fair understanding of it's strengths and weaknesses. My personal feeling is that it's been overused and abused but that the idea that we should never use it is kind of silly. The idea that we must choose 'SQL always' or 'SQL never' is a false dichotomy.

As far as SQL injection being an argument for not using SQL, that's laughable. This is a well understood problem with a pretty simple solution. The problem with this argument is that SQLi isn't the only vulnerability that exists. If you think that using JSON APIs makes you safe, you are in for a big surprise.

I think every developer should watch this video titled "Friday the 13th: Attacking JSON - Alvaro Muñoz & Oleksandr Mirosh - AppSecUSA 2017"

If you don't have the time or inclination to watch through it, here's the gist: A lot of JSON deserialization libs have remote code execution vulnerabilities. If you are using XML, you have even more to worry about. Banning SQL from your architecture will not make your system secure.

Answer

does he just want people to stop using SQL/Relational Databases because of SQLi attacks?

The 'Bobby Tables' article seems to suggest that this, it and of itself is a reason to not use SQL:

The solution. The only solution. Is to eliminate SQL from the system entirely. If there is no SQL engine, then there can be no SQLi attacks.

He might have other reasons that he discusses elsewhere. I wouldn't know because I don't really read much of his stuff.

Digression

This part isn't really an answer, but I think the question of the value of SQL is far more interesting (as do others, apparently.)

I've had a lot of experience using SQL and I think I have a fair understanding of its strengths and weaknesses. My personal feeling is that it's been overused and abused, but that the idea that we should never use it is kind of silly. The idea that we must choose 'SQL always' or 'SQL never' is a false dichotomy.

As far as SQL injection being an argument for not using SQL, that's laughable. This is a well understood problem with a pretty simple solution. The problem with this argument is that SQLi isn't the only vulnerability that exists. If you think that using JSON APIs makes you safe, you are in for a big surprise.

I think every developer should watch this video titled "Friday the 13th: Attacking JSON - Alvaro Muñoz & Oleksandr Mirosh - AppSecUSA 2017"

If you don't have the time or inclination to watch through it, here's the gist: A lot of JSON deserialization libraries have remote code execution vulnerabilities. If you are using XML, you have even more to worry about. Banning SQL from your architecture will not make your system secure.

2 'vast' was not really the right word
source | link

Answer

does he just want people to stop using SQL/Relational Databases because of SQLi attacks?

The 'Bobby Tables' article seems to suggest that this, it and of itself is a reason to not use SQL:

The solution. The only solution. Is to eliminate SQL from the system entirely. If there is no SQL engine, then there can be no SQLi attacks.

He might have other reasons that he discusses elsewhere. I wouldn't know because I don't really read much of his stuff.

Digression

This part isn't really an answer but I think the question of the value of SQL is far more interesting (as do others, apparently.)

I've had a lot of experience using SQL and I think I have a fair understanding of it's strengths and weaknesses. My personal feeling is that it's been overused and abused but that the idea that we should never use it is kind of silly. The idea that we must choose 'SQL always' or 'SQL never' is a false dichotomy.

As far as SQL injection being an argument for not using SQL, that's laughable. This is a well understood problem with a pretty simple solution. The problem with this argument is that SQLi isn't the only vulnerability that exists. If you think that using JSON APIs makes you safe, you are in for a big surprise.

I think every developer should watch this video titled "Friday the 13th: Attacking JSON - Alvaro Muñoz & Oleksandr Mirosh - AppSecUSA 2017"

If you don't have the time or inclination to watch through it, here's the gist: A vast numberlot of JSON deserialization libs have remote code execution vulnerabilities. If you are using XML, you have even more to worry about. Banning SQL from your architecture will not make your system secure.

Answer

does he just want people to stop using SQL/Relational Databases because of SQLi attacks?

The 'Bobby Tables' article seems to suggest that this, it and of itself is a reason to not use SQL:

The solution. The only solution. Is to eliminate SQL from the system entirely. If there is no SQL engine, then there can be no SQLi attacks.

He might have other reasons that he discusses elsewhere. I wouldn't know because I don't really read much of his stuff.

Digression

This part isn't really an answer but I think the question of the value of SQL is far more interesting (as do others, apparently.)

I've had a lot of experience using SQL and I think I have a fair understanding of it's strengths and weaknesses. My personal feeling is that it's been overused and abused but that the idea that we should never use it is kind of silly. The idea that we must choose 'SQL always' or 'SQL never' is a false dichotomy.

As far as SQL injection being an argument for not using SQL, that's laughable. This is a well understood problem with a pretty simple solution. The problem with this argument is that SQLi isn't the only vulnerability that exists. If you think that using JSON APIs makes you safe, you are in for a big surprise.

I think every developer should watch this video titled "Friday the 13th: Attacking JSON - Alvaro Muñoz & Oleksandr Mirosh - AppSecUSA 2017"

If you don't have the time or inclination to watch through it, here's the gist: A vast number of JSON deserialization libs have remote code execution vulnerabilities. If you are using XML, you have even more to worry about. Banning SQL from your architecture will not make your system secure.

Answer

does he just want people to stop using SQL/Relational Databases because of SQLi attacks?

The 'Bobby Tables' article seems to suggest that this, it and of itself is a reason to not use SQL:

The solution. The only solution. Is to eliminate SQL from the system entirely. If there is no SQL engine, then there can be no SQLi attacks.

He might have other reasons that he discusses elsewhere. I wouldn't know because I don't really read much of his stuff.

Digression

This part isn't really an answer but I think the question of the value of SQL is far more interesting (as do others, apparently.)

I've had a lot of experience using SQL and I think I have a fair understanding of it's strengths and weaknesses. My personal feeling is that it's been overused and abused but that the idea that we should never use it is kind of silly. The idea that we must choose 'SQL always' or 'SQL never' is a false dichotomy.

As far as SQL injection being an argument for not using SQL, that's laughable. This is a well understood problem with a pretty simple solution. The problem with this argument is that SQLi isn't the only vulnerability that exists. If you think that using JSON APIs makes you safe, you are in for a big surprise.

I think every developer should watch this video titled "Friday the 13th: Attacking JSON - Alvaro Muñoz & Oleksandr Mirosh - AppSecUSA 2017"

If you don't have the time or inclination to watch through it, here's the gist: A lot of JSON deserialization libs have remote code execution vulnerabilities. If you are using XML, you have even more to worry about. Banning SQL from your architecture will not make your system secure.

1
source | link

Answer

does he just want people to stop using SQL/Relational Databases because of SQLi attacks?

The 'Bobby Tables' article seems to suggest that this, it and of itself is a reason to not use SQL:

The solution. The only solution. Is to eliminate SQL from the system entirely. If there is no SQL engine, then there can be no SQLi attacks.

He might have other reasons that he discusses elsewhere. I wouldn't know because I don't really read much of his stuff.

Digression

This part isn't really an answer but I think the question of the value of SQL is far more interesting (as do others, apparently.)

I've had a lot of experience using SQL and I think I have a fair understanding of it's strengths and weaknesses. My personal feeling is that it's been overused and abused but that the idea that we should never use it is kind of silly. The idea that we must choose 'SQL always' or 'SQL never' is a false dichotomy.

As far as SQL injection being an argument for not using SQL, that's laughable. This is a well understood problem with a pretty simple solution. The problem with this argument is that SQLi isn't the only vulnerability that exists. If you think that using JSON APIs makes you safe, you are in for a big surprise.

I think every developer should watch this video titled "Friday the 13th: Attacking JSON - Alvaro Muñoz & Oleksandr Mirosh - AppSecUSA 2017"

If you don't have the time or inclination to watch through it, here's the gist: A vast number of JSON deserialization libs have remote code execution vulnerabilities. If you are using XML, you have even more to worry about. Banning SQL from your architecture will not make your system secure.