5 ms·
> And placeholders make any input sanitization unnecessary, because it's the library that does the escaping part of constructing a query. I quietly hope that t
by qb45 10y ago
> And placeholders make any input sanitization unnecessary, because it's the library that does the escaping part of constructing a query.
I quietly hope that they don't send concatenated query full of escapes, but some binary encoding of the query structure followed by serialized data parameters.
Otherwise there would be a whole business of exploiting those escapers. And wasted bandwidth.
- dozzie 10y agoAccording to how DBI, DBAPI2, and PDO are designed, it's database driver's job to add escaping as appropriate (if not using binary encoding; but this is driver's call, too), so there's not much to exploit. Remember that you don't only quote single-quotes with a backslash, you also need to quote backslashes in raw input, too. Only the bandwidth could be of any concern, but I don't remember any database with a text-based communication protocol.
- lmm 10y ago> Only the bandwidth could be of any concern, but I don't remember any database with a text-based communication protocol. Huh? MySQL at least you can telnet into and query with a text protocol, no?
- lgas 10y agoNo.
- qb45 10y agoThere is much to exploit if the driver itself is buggy. Theoretically it's possible that between various 8bit/16bit encodings, locales, collations, client/server configuration mismatches somebody could find a creative way to smuggle some unescaped quotemark. Binary protocol which parses SQL commands client-side and treats strings as blobs of bytes removes any chance of SQL injection for good.