3 ms·
If you're storing "Bob'; drop tables students --" in the database, you had to have sanitized your inputs, or there would be no students table. The article titl
by ehutch79 5y ago
If you're storing "Bob'; drop tables students --" in the database, you had to have sanitized your inputs, or there would be no students table.
The article title says NOT to sanitize inputs. perhaps it's that nuance doesn't fit in a headline, but eh...
- wvenable 5y agoThe confusion is what is input and what is output. The string "Bob'; drop tables students --" should not be sanitized/encoded on *input* to the application. However, if you're not using parameterized queries, it should be encoded on *output* to the database. Data should only be sanitized in transit and not stored in an sanitized form. That's what the article is really saying.
- IshKebab 5y agoNo you don't. You use a parameterized query: execute("INSERT INTO foo VALUES (?)", user_input)