4 ms·
That's the same side benefit that every SQL database has built in too, right? Pretty much every relational database has supported parameterized queries for, li
by jasonkester 17y ago
That's the same side benefit that every SQL database has built in too, right? Pretty much every relational database has supported parameterized queries for, like, ten years. They're uninjectable and actually less work than constructing strings.
It's amazing that people are still constructing SQL queries as strings in 2010.
- ars 17y agoSometimes you also need to change the query itself, i.e. the tables that are joined, or the sort order.
- jasonkester 17y agoIndeed. And you either do that in Stored Procedures using parameters that you've passed in (without manipulating them as strings), or you construct your parameterized query on the webserver with the joins and sorts that you need, and then pass it to the database along with the parameters it needs to stick in. Like I said. It's a solved problem, and has been so for a dozen years now.