4 ms·

Another sign: check the mysql queries. If they don't properly escape variables, danger.

• jacksoncarter 16y ago
  if they escape variables: danger! Escaping is not sufficient to prevent SQL Injection Attacks. You must used Parameterized Queries. http://bobby-tables.com/ http://bobby-tables.com/
  • chime 16y ago
    > Escaping is not sufficient to prevent SQL Injection Attacks. Do you have an example or idea of how a SQL injection could occur despite using http://php.net/manual/en/function.mysql-real-escape-string.php http://php.net/manual/en/function.mysql-real-escape-string.p... ?
    • deleted 16y ago
      [deleted]
    • deleted 16y ago
      [deleted]
  • code_duck 16y ago
    I'm pretty sure the audience on HN understands sql injection without having to refer to a cartoon.
    • deleted 16y ago
      [deleted]
    • hallmark 16y ago
      Yes, but Little Bobby Tables is an inside joke for the HN audience. I love that comic!
      • code_duck 16y ago
        It's a good one, no doubt. And it's true that the resources of the linked site go beyond the world of drawn panes.