3 ms·
Parametrized queries still use escaping. The only difference is instead of you doing the escaping and query construction you're letting someone else's code hand
by epochwolf 17y ago
Parametrized queries still use escaping. The only difference is instead of you doing the escaping and query construction you're letting someone else's code handle it for you. (Code I would assume is far better tested than yours)
- crux_ 17y agoa) More importantly, they enforce a discipline on you: never treat data as code. b) I'm guessing there are plenty of databases that execute parametrized queries entirely differently than a plaintext ones, including the absence of an escaping step. Since the whole point of quoting + escaping is to demarcate the "data" parts of a query, and you've already done that with parameters, there's no reason a query engine can't use the parameter directly rather than run it through a useless escape then parse-and-unescape cycle.
- tptacek 17y agoThis isn't really an accurate description of what's happening in a parameterized query. In most cases, parameterized queries have already been parsed by the time inputs are interpolated into them; if you look at the protocol on the wire, you can see the difference between query structure and slots. SQL Injection vulnerabilities happen when inputs influence the parsing of the query. You can't do that when the database already has an AST for the query. Parameterized queries are not just a different kind of quoting.