3 ms·
This is why in my new project I decided to use prepared statements wherever possible, it seemed like simply the best choice because sanitizing is never perfect.
by collegeburner 5y ago
This is why in my new project I decided to use prepared statements wherever possible, it seemed like simply the best choice because sanitizing is never perfect. Here's the article that convinced me in case anybody else wants to read: https://kevinsmith.io/sanitize-your-inputs/ https://kevinsmith.io/sanitize-your-inputs/
- MattPalmer1086 5y agoThis is absolutely the best mitigation for SQL injection. It can also speed up your queries as it allows better caching of the query plan. It always annoys me when SAST products on detecting injection advise using better input validation. No! Use parameterised queries and be done with it.
- illvm 5y agoInput validation is more general and helps mitigate other types of vulnerabilities, such as overflows and other injection attacks.
- MattPalmer1086 5y agoI'm all for defence in depth, and agreed there are many other types of injection attack this doesn't mitigate.
- Shorn 5y agoUntil someone wants to do something slightly different, can't figure out how to make it work because they've tried nothing and are all out of ideas - so they just use string concatenation and execute the string dynamically. Ask me how I know.