3 ms·
Use placeholders in prepared statements. "Sanitising" your input, banning magic words etc is hacky and fragile by comparison.
by mooism2 16y ago
Use placeholders in prepared statements. "Sanitising" your input, banning magic words etc is hacky and fragile by comparison.
- redredraider 16y agoI never thought of this. It's good
- MattBearman 16y agoI said in my article someone would show me a better way and this is it - I'd never seen prepared statements before now, but you can bet I'll be using them from now on. For anyone else who isn't sure what they are: prepared statements involves sending a template style query and parameters to the SQL api separately, eg: query template: "select * from users where username = ?" Parameter: "Matt" The SQL api knows that one is a query and one is just a parameter so injection is impossible