4 ms·
Doing your own escaping is digital whack-a-mole. Let the experts who wrote the prepared statement interface handle it. The knowledge of a team and/or years of e
by jagged-chisel 1y ago
Doing your own escaping is digital whack-a-mole. Let the experts who wrote the prepared statement interface handle it. The knowledge of a team and/or years of experience compressed into an interface that’s trivial to use.
- ameliaquining 1y agoParameterized statements don't actually abstract over escaping; they entirely obviate the need for it, by moving the untrusted data out of band.
- jagged-chisel 1y agoIt’s the safest interface to your database query engine no matter how it does the job. That’s what matters.