4 ms·
"Another is to “use SQL libraries that take care of input sanitization for them,” Al-Bassam suggested. This, in short, scrubs any data entered by the user to re
by billpg 11y ago
"Another is to “use SQL libraries that take care of input sanitization for them,” Al-Bassam suggested. This, in short, scrubs any data entered by the user to remove any potential malicious parts of it."
This is bad advice. Some people have apostrophes in their name. Deal with it.
Shameless plug: http://blog.hackensplat.com/2013/09/never-sanitize-your-inputs.html http://blog.hackensplat.com/2013/09/never-sanitize-your-inpu...
- seanwilson 11y agoPretty sure he would have meant sanitization as in escaping characters like quotes and not just deleting quotes.
- anton_gogolev 11y agoEscaping won't help. Parameterized queries all the way.
- seanwilson 11y agoSure, I really meant always use some library that will do whatever is needed to pass potential unsafe characters over to SQL and that sanitization doesn't mean you have to delete these characters. Obviously relying on yourself to properly escape everything is going to fail.