4 ms·
If you don't trust developers to use prepared statements, banning input strings with apostrophes can be a blunt way to avoid SQL injection attacks. Robert'); D
by nayuki 4y ago
If you don't trust developers to use prepared statements, banning input strings with apostrophes can be a blunt way to avoid SQL injection attacks.
Robert'); DROP TABLE Students;-- https://xkcd.com/327/ https://xkcd.com/327/
- vincent-manis 4y agoAh, the old “make things easy for the computer” philosophy, much less work than diligently sanitizing input.
- LinAGKar 4y agoBut it's not easy for the computer, since it needs to recompile the statement every single time. It's just easy for the programmer, and even that is questionable.
- andreareina 4y agoNot trusting your developers to use prepared statements is a big problem beyond the sqli
- yosito 4y agoA big problem that many, many organizations have, unfortunately.
- P5fRxh5kUvp2th 4y agoI _just_ rejected a PR yesterday from a contractor that did the initial checkin of a new project with no .gitignore file and all the build artifacts (everything under obj and bin directories). Why in the world am I having to protect the project from such things? I understand ignorance, but the person putting together the base of the project should know what the hell is going on.
- andreareina 4y agoOof. And I was just lamenting repos littered with .DS_Store files...
- ProtoAES256 4y agoDamn you Bobby Tables!!! (fist hanging in the air)