3 ms·
You can have perfectly valid input escaping without needing prepared statements. Many ORMs handle this without the need for PREPARE/EXECUTE.
by YorickPeterse 9y ago
You can have perfectly valid input escaping without needing prepared statements. Many ORMs handle this without the need for PREPARE/EXECUTE.
- mschuster91 9y ago> You can have perfectly valid input escaping without needing prepared statements. People have bypassed this far too often for my taste, and there is a reason why SQL (and other injections) are Top 1 of OWASP (1st place actually, both in RC1 and 2 of 2017, but also in the 2013 edition). Never, ever trust any form of escaping or it will bite you. Hard.
- ris 9y ago> Never, ever trust any form of escaping or it will bite you. Hard. This is an absurd dogmatic statement. Everybody trusts a multitude of escapings everywhere every day all over the web without even knowing it.
- anonacct37 9y agoHow much do you trust the postgres developers? https://www.postgresql.org/docs/9.1/static/libpq-exec.html#LIBPQ-EXEC-ESCAPE-STRING https://www.postgresql.org/docs/9.1/static/libpq-exec.html#L...