3 ms·
Sql sanitization isn't foolproof either. That is why prepared statements are the best practice.
by zaphar 3y ago
Sql sanitization isn't foolproof either. That is why prepared statements are the best practice.
- blep_ 3y agoSQL sanitation is foolproof in the sense of it being possible to do 100% right. We don't do it much because there are other options (like prepared statements) that are easier to get 100% right. This is an entirely different thing from trying to reduce the probability of an attack working.
- zaphar 3y agoEverything is in theory possible to do 100% right. The difficulty of doing so is why people choose better solutions, like prepared statements.
- Dylan16807 3y agoThe only part that isn't foolproof is remembering to do it. If you run the sanitization function, it will work. Unless you're using a build of msyql that predates mysql_real_escape_string, because the _real version takes the connection character set into account and the previous version didn't.