10 ms·
I don't understand how SQL injection still exists as a problem. Isn't it pretty much completely solved by using an ORM or prepared statements? Is it just lazine
by city41 14y ago
I don't understand how SQL injection still exists as a problem. Isn't it pretty much completely solved by using an ORM or prepared statements? Is it just laziness that allows it to fester on, or is there something I'm missing?
- jdbevan 14y agoIt's a combination of laziness, ignorance and a reluctance to migrate/fix legacy code.
- wglb 14y agoPrepared statements won't handle variable table names. Thus if your application builds a table name from user-influenced input, you need to do an extra step of sanitization that prepared statements won't do.