4 ms·
Is this serious? It seems to prevent SQL injection by only allowing statically defined strings to be interpolated. So basically not allowing any kind of dynamic
by olavk 8y ago
Is this serious? It seems to prevent SQL injection by only allowing statically defined strings to be interpolated. So basically not allowing any kind of dynamic or user input.
- kuschku 8y agoThat’s the point. You should never use string interpolation with strings defined at runtime for SQL. Always build your queries out of strings defined at compile time and use them as prepared statements with parameters.
- pjmlp 8y agoThat is the theory, sadly it doesn't work everywhere on the SQL statement. So we always end up with a mix of prepared statements and string manipulation.
- C4K3 8y agoIt works by only allowing statically defined strings to be used for SQL /statements/, it still works for dynamic input. https://en.wikipedia.org/wiki/Prepared_statement https://en.wikipedia.org/wiki/Prepared_statement The ? is a placeholder for dynamic values, the user input is bound to it.