4 ms·
but? It think it's far deeper than mitigation, it's the solution. Edit: I apologize for getting 'sanitation' wrong. Don't do it.
by mro_name 5y ago
but? It think it's far deeper than mitigation, it's the solution.
Edit: I apologize for getting 'sanitation' wrong. Don't do it.
- jdlshore 5y agoThe proper solution to SQL injection is parameterized queries, not input sanitization, to my knowledge.
- deleted 5y ago[deleted]
- drunkpotato 5y agoThe irony here is that if you use the log4j equivalent of parameterized queries, parameterized logging strings, you're still vulnerable to this CVE, even if you did everything right.
- AnotherGoodName 5y agoFor databases you simply parametize the inputs so that code is code and data is data and there's no mixing of the two. Sanitization is a defence of last resort when you simply can't separate code and data. Usually used for user content on the web since HTML has no formal mechanism to separate code and data because the angled brackets that do this separation are also valid user input. But databases do have a way to separate the query from the data. Parametize your queries.
- mro_name 5y agoIndeed. That's enforced system boundaries.
- deleted 5y ago[deleted]