3 ms·

how lame, do AR devs need someone to remind them about bind variables/params ?

• Robin_Message 14y ago
  (rant) Since Rails devs don't appear to believe in databases (and to be fair, if I was targeting MySQL version 3 I'm not sure I would believe in them much either), they don't bother using database features for binding. Instead having their own half baked (well, it 90% baked now, but it still has the occasional squishy bit) binding system. Same for validations, foreign keys, primary keys, indexes, enumerations, etc. (/rant)
  • benmmurphy 14y ago
    the places where these sql injections were happening wouldn't be prevented from traditional sql bindings which are applied to parts of the where clause or set values. in JDBC land i don't think you can do "SHOW TABLES FROM ? WHERE ...."
• amalag 14y ago
  Binding variables is prepared statements? AR does support that, how does that affect this vulnerability?