3 ms·
Yes, but you had better be 100% sure that your escaping function is completely reliable, and the server hasn't introduced some new syntax since you wrote it tha
by mnw21cam 13y ago
Yes, but you had better be 100% sure that your escaping function is completely reliable, and the server hasn't introduced some new syntax since you wrote it that you aren't escaping properly.
I would trust parameters much more (although I have used proper escaping in the past).
- throwaway0010 13y agoA few popular database drivers use escaping under the hood for parameterized query arguments. mysql2 ruby gem (and any rails stack on top of it) for example.
- astrodust 13y agoThey probably do a better job of it than you do, so let them handle it.