4 ms·
"Maybe I'm misunderstanding you, but it looks like it is a PHP specific problem. Python does not have it." You can concatenate a sql query just fine in Python
by ransom1538 5y ago
"Maybe I'm misunderstanding you, but it looks like it is a PHP specific problem. Python does not have it."
You can concatenate a sql query just fine in Python anyway you want. Adding a sql injection is just as easy in Python, PHP, or lisp. Thus this is a choice. Nothing to do with a language. Language bashing is gross and spreads lies. And yes, you can bind an array of params in PHP.
- jve 5y agoActually if you use .NET EF Core 2 FromSql or ExecuteSqlCommand, you get parametrized queries from string interpolation for free: https://docs.microsoft.com/en-us/ef/core/what-is-new/ef-core-2.0/#string-interpolation-in-fromsql-and-executesqlcommand https://docs.microsoft.com/en-us/ef/core/what-is-new/ef-core...