3 ms·
> It also makes it so easy to create opportunities for SQL injection if you don't have careful coders. This is not the case. If you bind values with :ITEM_NAME
by phartenfeller 2y ago
> It also makes it so easy to create opportunities for SQL injection if you don't have careful coders.
This is not the case. If you bind values with :ITEM_NAME and use compiled statements (never dynamic string concatenated ones with "execute immediate') there is no chance of SQL injection.
- forinti 2y agoYou can set items from the URL, which you usually can't do with most web frameworks. Of course you can enable Session State Protection, but you have to be vigilant. You can also inadvertently leave a page public.