4 ms·
Other than probably historical reasons and interface definitions, is there any reason why this is the case? I can't immediately think of any sensible argument a
by shabble 14y ago
Other than probably historical reasons and interface definitions, is there any reason why this is the case? I can't immediately think of any sensible argument against allowing the binding of a value into a limit/order field. In fact, it should be type-checking/converting it as well, to prevent exactly mistakes like this.
Even if the DB interface doesn't directly support this, it seems like it's something all client wrappers should handle, preferably at the low level in addition to having to pull in a whole ORM + assorted bacon for the purpose.
- tptacek 14y agoEasy: bound parameters are a performance feature, not a security feature.