3 ms·
According to how DBI, DBAPI2, and PDO are designed, it's database driver's job to add escaping as appropriate (if not using binary encoding; but this is driver'
by dozzie 11y ago
According to how DBI, DBAPI2, and PDO are designed, it's database driver's job
to add escaping as appropriate (if not using binary encoding; but this is
driver's call, too), so there's not much to exploit. Remember that you don't
only quote single-quotes with a backslash, you also need to quote backslashes
in raw input, too. Only the bandwidth could be of any concern, but I don't
remember any database with a text-based communication protocol.
- lmm 11y ago> Only the bandwidth could be of any concern, but I don't remember any database with a text-based communication protocol. Huh? MySQL at least you can telnet into and query with a text protocol, no?
- lgas 11y agoNo.
- qb45 11y agoThere is much to exploit if the driver itself is buggy. Theoretically it's possible that between various 8bit/16bit encodings, locales, collations, client/server configuration mismatches somebody could find a creative way to smuggle some unescaped quotemark. Binary protocol which parses SQL commands client-side and treats strings as blobs of bytes removes any chance of SQL injection for good.