3 ms·
This is absolutely the best mitigation for SQL injection. It can also speed up your queries as it allows better caching of the query plan. It always annoys me
by MattPalmer1086 5y ago
This is absolutely the best mitigation for SQL injection.
It can also speed up your queries as it allows better caching of the query plan.
It always annoys me when SAST products on detecting injection advise using better input validation. No! Use parameterised queries and be done with it.
- illvm 5y agoInput validation is more general and helps mitigate other types of vulnerabilities, such as overflows and other injection attacks.
- MattPalmer1086 5y agoI'm all for defence in depth, and agreed there are many other types of injection attack this doesn't mitigate.