3 ms·
The argument is that prompt injection protection is possible. Not that it is perfect. SQL injection protection is also not perfect
by gitfan86 4y ago
The argument is that prompt injection protection is possible. Not that it is perfect. SQL injection protection is also not perfect
- ceejayoz 4y ago> SQL injection protection is also not perfect It is, though. Parameterized queries perfectly protect against SQL injection. If I have a properly parameterized query like `SELECT foo FROM bar WHERE x=?`, you're not escaping from that `?`. Period.
- gitfan86 4y agoI'm not talking about parameterization. I'm talking about SQL injection. Just look at all the CVEs related to SQL injection. It isn't a solved problem.
- ceejayoz 4y agoParametization is the solution to SQL injection. It's a solved problem, people are just still writing non-parameterized queries.