4 ms·
Insert a line of code before that statement which validates that the variable is an integer and you're sorted. As an added bonus, check that it's in range.
by radicalbyte 7y ago
Insert a line of code before that statement which validates that the variable is an integer and you're sorted. As an added bonus, check that it's in range.
- mirashii 7y agoPlease don't. Use placeholders and the DB's prepared statements API _everywhere_. Manual escaping and validation is a recipe for disaster.
- Rychard 7y agoSad as it is to say, but this is a quick way to get your PR stuck in code-review hell. If the code you're starting with is already in such a state, the chances of the reviewer being: 1. able to understand what you've done 2. receptive to unnecessary functional changes to a legacy application ... is effectively 0.
- radicalbyte 7y agoAbsolutely - that is the desired end state. In some languages migrating to the prepared statement API can be a considerable amount of work and that takes a lot of time. If the code is mainly made up of queries with an integer ID then you can make the code safe using guards with a fraction of the effort meaning that your software is stable faster. Then you can take your time rewriting your data access layer to use the safe-by-design APIs. I should have made that clear in my original post :) BTW at some point you might need to get into escaping / validation to support operations not supported by the safe APIs. If/when you encounter this it's a massive red flag. Your system design should reflect that. It should be treated like radioactive waste: be paranoid.