4 ms·
Please don't. Use placeholders and the DB's prepared statements API _everywhere_. Manual escaping and validation is a recipe for disaster.
by mirashii 7y ago
Please don't. Use placeholders and the DB's prepared statements API _everywhere_. Manual escaping and validation is a recipe for disaster.
- Rychard 7y agoSad as it is to say, but this is a quick way to get your PR stuck in code-review hell. If the code you're starting with is already in such a state, the chances of the reviewer being: 1. able to understand what you've done 2. receptive to unnecessary functional changes to a legacy application ... is effectively 0.
- radicalbyte 7y agoAbsolutely - that is the desired end state. In some languages migrating to the prepared statement API can be a considerable amount of work and that takes a lot of time. If the code is mainly made up of queries with an integer ID then you can make the code safe using guards with a fraction of the effort meaning that your software is stable faster. Then you can take your time rewriting your data access layer to use the safe-by-design APIs. I should have made that clear in my original post :) BTW at some point you might need to get into escaping / validation to support operations not supported by the safe APIs. If/when you encounter this it's a massive red flag. Your system design should reflect that. It should be treated like radioactive waste: be paranoid.