3 ms·
I understand what you are saying but this has nothing to do with names but with SQL injections, escaping and prepared statements (the lack of).
by huuu 10y ago
I understand what you are saying but this has nothing to do with names but with SQL injections, escaping and prepared statements (the lack of).
- jameshart 10y agoIt has everything to do with names. Among the things that programmers sometimes believe about names, as in this case, is that when you stick apostrophes around them they are always a valid SQL string literal.
- biot 10y agoInexperienced programmers naively believe that about all string input, so the fact they believe it about names isn't particularly interesting.