2 ms·
> even if we were, that type system wizardry wouldn't help a whole ton in getting strings from browser A into database B and back again. Some of it does. The u
by maccard 4y ago
> even if we were, that type system wizardry wouldn't help a whole ton in getting strings from browser A into database B and back again.
Some of it does. The usage of two separate types for validated and unvalidated input entirely removes a class of bugs from the programmer, and enforces it at compile time, making:
string my_str = <some untrusted input>;
db.exec("select * from A where name='{0}'", my_str)
A compiler error instead of an SQL injection.
- krapp 4y ago>db.exec("select * from A where name='{0}'", my_str) In any sane framework, that would be using prepared statements under the hood, so it shouldn't matter.