6 ms·
Until you run across code that's doing something like: def search(key, value): query("select * from my_table where `" + key + "` = '" + value + "'"
by nucleardog 6y ago
Until you run across code that's doing something like:
def search(key, value):
query("select * from my_table where `" + key + "` = '" + value + "'")
Not that I'm suggesting this is a good thing to do, but it's not something you can simply replace with a single line of context or easily.
- nicoburns 6y agoI believe you could handle that case with an escaping function for the `key` variable. Column names are generally quite restricted in what characters they can contain, so this is fairly easy to do in a water-tight way. Of course this won't restrict which column you're giving access to, but a WAF won't catch that either.