5 ms·
Escaping won't help. Parameterized queries all the way.
by anton_gogolev 11y ago
Escaping won't help. Parameterized queries all the way.
- seanwilson 11y agoSure, I really meant always use some library that will do whatever is needed to pass potential unsafe characters over to SQL and that sanitization doesn't mean you have to delete these characters. Obviously relying on yourself to properly escape everything is going to fail.