4 ms·
Sorry, whitelisting isn't the answer to SQL injection - bind parameters are. With bind parameters you can pass data out of band, and the DB engine never tries
by perlgeek 16y ago
Sorry, whitelisting isn't the answer to SQL injection - bind parameters are.
With bind parameters you can pass data out of band, and the DB engine never tries to parse it as SQL.
- leif 16y agoYou're right, of course, that you should never use user-input data as code. SQL bind parameters solve this problem for SQL. I'm sure there exist other things without such an easy solution, in which case you do need to sanitize with a whitelist.
- tptacek 16y agoI wasn't trying to be prescriptive about SQL injection. But, it always skeeves me out when people knee-jerk out "parameterized queries" as the answer to SQL injection. Yes, they're better and safer and you should use them wherever you can. But they don't "solve" SQL injection; for instance, there are query fragments that can't be parameterized (which is why you still find SQL injection in sortable table headers and in pagination and in custom query builders). Be careful.