4 ms·
Huh, no? Tt's very easy to do it incorrectly. It's at best equal... unless there is some SQL driver/client somewhere that disallows hardcoded strings everywhe
by silon42 3y ago
Huh, no?
Tt's very easy to do it incorrectly.
It's at best equal... unless there is some SQL driver/client somewhere that disallows hardcoded strings everywhere (that would actually really help).
- throwaway894345 3y agoDon't pass interpolated strings to the SQL driver? It seems super easy to do `exec("select * from table where column1=?")` instead of `exec(sprintf("select * from table where column1='%s'", user_data))`. If someone is doing the latter and they're super junior, it's a teachable moment. If they're not super junior I'm wondering what else they're sloppy about and if they need handholding (or worse).