3 ms·
You don't even have to do that, just escape single quotes and you've defeated everything but homomorphic attacks as far as I can tell.
by hobs 3y ago
You don't even have to do that, just escape single quotes and you've defeated everything but homomorphic attacks as far as I can tell.
- tester756 3y agoWhy use unreliable solutions that rely on various assumptions that may change in the future and rely on you not forgetting about even 1 case where it wouldnt work When you can use approach which fundamentally prevents SQL injection?
- hobs 3y agoI didn't say you should, I am just noting that there's no complexity in the solution required, it's simple and yet still many people don't do it.
- dylan604 3y agoThat’s a comment that makes me think someone read a blog 15 years ago, and never kept up with modern ways of doing things.
- hobs 3y agoCool - but neither of your comments addressed that I am still correct afaict, if you care about query plans and such parameterization is important, but not getting injected on is a different problem.
- dylan604 3y agolook, if you still want to live like it's 1999, then sure, go ahead and wrap your params in quotes like you think you can. just don't come crying to the rest of us that have more than once provided you with better solutions when you get attacked. i mean, even using the old style escape methods would be better than your appending of quotes idea.
- hobs 3y agoI didn't say I don't use parameterization, and I still haven't heard what the difference is between the old style escape methods and the quotes I mentioned, just you being salty :)