3 ms·
I know the PHP/PDO way to do it, is prepared statements. I'm not able to see why the parent's suggestion to just escape the strings is not a valid solution fro
by readme 13y ago
I know the PHP/PDO way to do it, is prepared statements.
I'm not able to see why the parent's suggestion to just escape the strings is not a valid solution from a security perspective.
- orf 13y agobecause you also have integer based SQL injection. Escaping strings isn't a complete fix.
- user24 13y agoYep. In fact the typical SQL injection example is " 0 OR 1=1 ".
- anoncow 13y ago>that's less secure than prepared statements, and may break some things (eg if the code is relying on certain things not being escaped, etc)
- deleted 13y ago[deleted]