4 ms·

Where are you are sanitizing the comments? You have literally provided a perfect SQL injection mechanism here and allowed arbitrary HTML to be inserted onto you

Where are you are sanitizing the comments? You have literally provided a perfect SQL injection mechanism here and allowed arbitrary HTML to be inserted onto your page.

klodolph 4y ago
HTML injection, yes. SQL injection, no. The insert is parameterized.
- cirrus3 4y ago
  Ok, I wasn't sure if DB.exec_params handled that