4 ms·
This advice doesn't sit right with me. I like to make sure my numbers don't contain chars. But that is about not breaking my data flow- not security.
by geoduck14 5y ago
This advice doesn't sit right with me. I like to make sure my numbers don't contain chars. But that is about not breaking my data flow- not security.
- JasonCannon 5y agoSure, I'm not talking about no validation or sanitation. I'm talking about as a security measure. Trust the far more secure parameters rather than thinking that escaping some quotes is going to protect you.
- _ndianabasi 5y agoThat's the purpose of validation. I think we was talking about sanitisation before storage. But I think that if there is a good validation, sanitisation is half taken care of. Sanitisation will still be indispensable even if one is using parameter bindings or prepared statements.