4 ms·
"don't concatenate input strings into SQL strings" is a pretty good comparison, because the rise of ORMs and APIs that make parameterized queries ergonomic has
by XMPPwocky 6y ago
"don't concatenate input strings into SQL strings" is a pretty good comparison, because the rise of ORMs and APIs that make parameterized queries ergonomic has done probably 10 times as much to stop SQLi in practice as telling developers to sanitize their inputs ever did.
- afandian 6y agoAgreed. But writing your own authentication frameworks are a virtually identical situation.
- tester756 6y ago>sanitize their inputs ever did. was even escaping input viable strategy? if you escape thing, then your data in db is broken parametrization seems like the only strategy out of those 2
- corty 6y agosome parts of a query cannot be parameterized, e.g. the column name for an 'order by' in many cases. So you have to do some kind of escaping, sanitation and concatenation.
- tester756 6y agoWhile this solution isn't sexy, cannot it be just simple switch? switch(int) case 1: age case 2: salary
- namibj 6y agoI have yet to dream up/see a case where you can't puzzle literals together based on user-query parsing until you get your SQL query assembled.
- corty 6y agoYes, unless the database has custom column names e.g. to add your own properties to some object. But that kind of schema is madness in other aspects as well...
- namibj 6y agoIf you're escaping/sanitizing to massage an input string until you can concatenate it into a SQL query, you're doing it wrong. Please don't.