3 ms·
Why can't a name simply be a string of length X? All this work of checking for "correct" names is so pointless.
by Tharre 10y ago
Why can't a name simply be a string of length X? All this work of checking for "correct" names is so pointless.
- throwanem 10y agoBadly written SQL generation often prompts single quotes being forbidden in input. "Having single quotes there breaks my queries," one sometimes hears said. "I don't know why." This is a great opportunity to mentor one's juniors. An injection attack is trivial to demonstrate in the local dev environment, and the result strongly motivates anyone worth working with to learn how not to do that again.
- projektfu 10y agoFor the 10,000 who might be learning about this today, the answer is prepared statements with placeholders for the values, like this pseudocode: stmt = driver.prepare("insert into names (firstname, lastname) values (?, ?)"); stmt.execute("Flannery", "O'Connor"); Syntax varies among database interfaces but this ensures that any odd strings are properly stored by the driver and the application does not need to worry about them. There is also no risk of someone rewriting the SQL statement.