4 ms·
Looks correct to me. What issue do you have with it? They're saying injection attacks come from dynamically building strings, so if you prevent that you stop t
by kpmah 8y ago
Looks correct to me. What issue do you have with it?
They're saying injection attacks come from dynamically building strings, so if you prevent that you stop the vulnerabilities.
- alexandernst 8y agoSQL Inject is not only a ' character. SQL Inject could be a blind query, subselect attack, time attack and so on and so on. This completely fails to prevent pretty much anything except the very naive and silly attacks.
- charriu 8y agoThis prevents dynamically created queries using lifetimes. It does not search for ' characters.
- swirepe 8y agoYup. But it does it at compile time for basically no work.
- CiPHPerCoder 8y agoNo it doesn't. The argument isn't "block ' characters to stop SQL injection" it's "force the developer to use prepared statements and no dynamically constructed queries".
- coldtea 8y agoFirst, no, it prevents much more attacks. Second, the naive and silly attacks are the default definition of SQL injection -- and the most commonly found holes, so even if it just prevented those that would be still a huge help. Nothing statically ensures that at runtime except the programmer's due diligence.
- microsuck 8y agoAm I just too dumb or is it really impossible for this code to exchange the username?