2 ms·
My understanding is that most drivers allow for a parameterized statement, which escapes quotes and otherwise makes SQL "safe" for database consumption. I've us
by bartonfink 16y ago
My understanding is that most drivers allow for a parameterized statement, which escapes quotes and otherwise makes SQL "safe" for database consumption. I've used those everywhere I've interacted with a database and have never heard an argument against it.
Of course, I've also never worked in a place that allowed stored procedures so I may be missing out on an advantage there.
- wladimir 16y agoIndeed, you should always use parametrized SQL statements. This ensures that injections are impossible. Don't bother with manually escaping parameters, as you are bound to forget one case. The NoSQL databases I've worked with always use the parametrized format (no text-based query format at all), so injection wasn't a problem.
- stcredzero 16y agoSo avoid anything that doesn't use parameterized SQL statements.
- bartonfink 16y agoYup. And, if you're writing anything that talks to a database, use a parameterized statement (sometimes called a prepared statement) instead of just concatenating strings. You will blow it if you concatenate strings and that's what we call SQL injection.