3 ms·
Is this a joke? I've never met someone who had a hard time with safe query parameterization. It's wrong to say sql can be replaced with "an api", it does not h
by Areading314 9y ago
Is this a joke? I've never met someone who had a hard time with safe query parameterization.
It's wrong to say sql can be replaced with "an api", it does not have the same flexibility, power, performance, etc. And would drastically slow down your development. Also, what is "the api" going to use? Text files?
It's better to teach people to practice safe SQL than to require abstinence.
- lostmsu 9y agoLast place I worked at had that problem (code injection) applied a lot to bash scripting. The problem was solved for SQL after libraries that do parametrized query building gained popularity.
- labster 9y agoI've never met a programmer who has a problem with learning parameterized SQL queries. But I've met plenty of old code that does, created before this sort of stuff was taught. In my experience, it's mostly the legacy code which has the greatest risks.
- jgh 9y agoI feel like this is a blog post from 2003 or something, and the audience is PHP developers who are writing inline SQL statements.
- red_admiral 9y ago> Also, what is "the api" going to use? Text files? A NoSQL datastore, of course :)
- deleted 9y ago[deleted]