4 ms·
They do provide a nice safety net against SQL injection though. A problem that Rails has from time to time.
by nirvdrum 13y ago
They do provide a nice safety net against SQL injection though. A problem that Rails has from time to time.
- zzzeek 13y agobound parameters are the safety net against SQL injection. Prepared statements are not a prerequisite for that depending on database client API. (e.g. psycopg2, doesn't use prepared statements).
- nirvdrum 13y agoI appreciate the comment, but since this was in regards to Rails, the two options were basically use prepared statements or don't. You don't get any safety without them and have to rely on Rails, which does an admirable job, but has faltered from time to time.
- saurik 13y agoIf Rails stops using the two-step parse/execute PostgreSQL commands (which are supported without issue by PGbouncer, and which is how you are supposed to get bound parameters) when prepared_statements is turned off (a setting which intuitively should only turn off using standard SQL named prepared statements), then that's pathetic behavior (even for Rails) and should really be fixed.