3 ms·
> do these attack vectors still apply to MySQL prepared statements? No.
by DrewHintz 17y ago
> do these attack vectors still apply to MySQL prepared statements?
No.
- tptacek 17y agoSure they do. All you have to do is find a query that uses user input to select a table, or that accepts an offset for pagination and doesn't explicitly typecast it. We find SQLI in parameterized queries all the time. You should absolutely use prepared statements, but don't kid yourself about their magic powers.