3 ms·
I hope you don't try and write a post with a singe quote in it! (You're directly interpolating the post content into a SQL query, rather than using parameteriz
by schrodinger 11y ago
I hope you don't try and write a post with a singe quote in it!
(You're directly interpolating the post content into a SQL query, rather than using parameterization. Similarly, you've got an injection vulnerability in your get, someone could infect arbitrary SQL into the post id.)
- condescendence 11y agoThere's not even user authentication and you're talking about SQL injection? >[WIP] DO NOT USE Please checkout the TODO list
- prawn 11y ago(I'm just the submitter, not the creator.)