3 ms·
Please read about SQL injection[0]. Not using a library that escapes your strings is how Bobby Tables[1] ruins your production database. [0] - https://en.wikip
by heartsucker 10y ago
Please read about SQL injection[0]. Not using a library that escapes your strings is how Bobby Tables[1] ruins your production database.
[0] - https://en.wikipedia.org/wiki/SQL_injection#Incorrectly_filtered_escape_characters https://en.wikipedia.org/wiki/SQL_injection#Incorrectly_filt...
[1] - https://xkcd.com/327/ https://xkcd.com/327/
- sleepychu 10y agoLove that XKCD :-) Maybe I misunderstood what you had in mind when you wrote string concatenation but concatenating untrusted raw strings and using a library to construct SQL queries are not the only two ways to produce a SQL query.
- jacquesm 10y agoAnd this is exactly how one would deal with such a situation.