4 ms·
> Parameterized queries are also simply not the panacea they're made out to be; there remain plenty of opportunities for injection even with a parameterized que
by jtdowney 16y ago
> Parameterized queries are also simply not the panacea they're made out to be; there remain plenty of opportunities for injection even with a parameterized query.
Can you describe a case or point to example code using a parameterized query that is vulnerable to SQL injection? I've seen a stored procedure that built raw queries and pass them to sp_executesql (T-SQL) that provided a vector for SQL injection. However I am struggling to think of a case where a parameterized query could allow for SQL injection.
- tptacek 16y agoNot every input to a query can be bound as a parameter. Simplest example: User.find_by_sql("SELECT * from users where name = ? LIMIT #{ limit }", name) Other examples: sort order (ASC/DESC), table selection, join columns, GROUP BY argument. If you think I'm arguing against parameterized queries: of course not. Use them. But know their limitations.