28 ms·
I was involved in those original discussions and it was just the standard “how to manipulate sql” discussion. Prepared statements don’t help you here, right? M
by aidos 6y ago
I was involved in those original discussions and it was just the standard “how to manipulate sql” discussion.
Prepared statements don’t help you here, right? My understanding is that they’re purely for performance as the parser doesn’t need to be rerun each time. You need to recreate them for every dB session.
- richardw 6y agoNo sql injection, can set permissions for each proc, isolates app from DB implementation so you don’t have to redeploy app. Eg you can migrate older data to an archive table and query it on certain circumstances. App doesn’t need to know.
- aidos 6y agoThat’s stored ptocedures you’re talking about - I think. We’re talking about prepared statements.
- Twisell 6y agoI'm not familiar enought with the execution context, i could be wrong and i totally get that theses are examples while final code would probably include escaping checks. But that being said some of the proposed solutions could probably lead to a little bobby table situation... https://xkcd.com/327/ https://xkcd.com/327/