4 ms·
Database drivers for mabny programming languages have something like Java's PreparedStatement which allows you to compile the SQL query together with code, befo
by 988747 4y ago
Database drivers for mabny programming languages have something like Java's PreparedStatement which allows you to compile the SQL query together with code, before the application is ran. Whatever input is provided later by the user cannot result in SQL injection, because it is not parsed/compiled at all. So yes, SQL injection is a solved problem, it's up to you whether you know about/use the solution.
- im3w1l 4y agoThe issue is that the type system doesn't enforce that the query is a literal / bundled resource.
- tremon 4y agoThe SQL language is not flexible enough to allow preparation of every possible query, so the problem is fundamentally not solved. To take a simple example: query parameters are not supported in DDL or DCL statements, and in DML queries the usage of parameters is limited to values only: even such a simple thing as an ORDER BY clause cannot be controlled by parameter insertion. "We have solutions for the most common occurrences" is not the same as "the problem is solved".