3 ms·
It's only a protection if properly used. Bound parameters don't work well for some types of dynamic queries.
by alttag 15y ago
It's only a protection if properly used. Bound parameters don't work well for some types of dynamic queries.
- corford 15y agoHow do other dynamic languages (e.g. Ruby, Python) deal with this? Also, if you've reached the point where PDO is too restrictive for what you want to do, you should be knowledgeable enough to write your own db class that incorporates sql injection protection (since all that largely consists of is escaping strings).