5 ms·
What do you have to do besides escaping special characters in input fields?
by Prrometheus 19y ago
What do you have to do besides escaping special characters in input fields?
- jfornear 19y agoEverytime SQL injection comes up everyone says how easy it is to prevent with one line of code, and then no one ever shares that one line! From Wikipedia: Using Parameterized Statements Parameterized statements use parameters (sometimes called placeholders or bind variables) instead of embedding user input in the statement. In many cases, the SQL statement is fixed. The user input is then assigned (bound) to a parameter. This is an example using Java and the JDBC API: PreparedStatement prep = conn.prepareStatement("SELECT * FROM USERS WHERE PASSWORD=?"); prep.setString(1, pwd);
- okeumeni 19y agoEmbedded SQL is poor programming period!