4 ms·

if they escape variables: danger! Escaping is not sufficient to prevent SQL Injection Attacks. You must used Parameterized Queries. http://bobby-tables.com/ h

if they escape variables: danger! Escaping is not sufficient to prevent SQL Injection Attacks. You must used Parameterized Queries. http://bobby-tables.com/ http://bobby-tables.com/

chime 16y ago
> Escaping is not sufficient to prevent SQL Injection Attacks. Do you have an example or idea of how a SQL injection could occur despite using http://php.net/manual/en/function.mysql-real-escape-string.php http://php.net/manual/en/function.mysql-real-escape-string.p... ?
- deleted 16y ago
  [deleted]
- deleted 16y ago
  [deleted]
code_duck 16y ago
I'm pretty sure the audience on HN understands sql injection without having to refer to a cartoon.
- deleted 16y ago
  [deleted]
- hallmark 16y ago
  Yes, but Little Bobby Tables is an inside joke for the HN audience. I love that comic!
  - code_duck 16y ago
    It's a good one, no doubt. And it's true that the resources of the linked site go beyond the world of drawn panes.