10 ms·
Incorrect handling I'd say. If you're filtering apostrophes from your user input you're doing it wrong.
by duncans 13y ago
Incorrect handling I'd say. If you're filtering apostrophes from your user input you're doing it wrong.
- undoware 13y agoThis is a semantic quibble. Your point could be restated as, "if you're not filtering potentially dangerous data out of your SQL queries (i.e. you're not using a fixed vocabulary of properly-quoted phrases) then you are vulnerable to SQLi." think of it this way: no matter how you slice it, there are Bad Things you need to keep out of your SQL, and an easy layperson term for doing so is 'filtering'. Recall that 'filter' != regexp.