3 ms·
This. If you aren't using prepared statements, you're doing it wrong.
by tuatoru 4y ago
This. If you aren't using prepared statements, you're doing it wrong.
- icedchai 4y agoI once worked on a system where the original developer, supposedly with 25+ years experience, did not know about prepared statements. He had developed his own home grown "ORM" that attempted to manually escape SQL. You can guess how well that worked out. We'd get SQL 'syntax errors' in production regularly.