3 ms·
SQL Inject is not only a ' character. SQL Inject could be a blind query, subselect attack, time attack and so on and so on. This completely fails to prevent pre
by alexandernst 8y ago
SQL Inject is not only a ' character. SQL Inject could be a blind query, subselect attack, time attack and so on and so on. This completely fails to prevent pretty much anything except the very naive and silly attacks.
- charriu 8y agoThis prevents dynamically created queries using lifetimes. It does not search for ' characters.
- swirepe 8y agoYup. But it does it at compile time for basically no work.
- CiPHPerCoder 8y agoNo it doesn't. The argument isn't "block ' characters to stop SQL injection" it's "force the developer to use prepared statements and no dynamically constructed queries".
- coldtea 8y agoFirst, no, it prevents much more attacks. Second, the naive and silly attacks are the default definition of SQL injection -- and the most commonly found holes, so even if it just prevented those that would be still a huge help. Nothing statically ensures that at runtime except the programmer's due diligence.