3 ms·
I used this just today to demonstrate to our developers why their attempts to fix SQL injection via real_escape_string and regex wasn't a good idea. Great tool.
by elktea 11y ago
I used this just today to demonstrate to our developers why their attempts to fix SQL injection via real_escape_string and regex wasn't a good idea. Great tool.
- 0x4a42 11y agoWhy using real_escape_string wouldn't help fixing sqli? Could you provide some examples? I know prepared statements are the way to go but proper escaping, even if tedious, seams to be OK for me.
- elktea 11y agoSome examples can be found here: http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string http://stackoverflow.com/questions/5741187/sql-injection-tha...