4 ms·
I don't think most people have a solid sense of what is acceptable safety for dynamic SQL. The goal is to avoid injections, so you have to ensure that can't hap
by spacemanmatt 12y ago
I don't think most people have a solid sense of what is acceptable safety for dynamic SQL. The goal is to avoid injections, so you have to ensure that can't happen. If you have a reliable way to quote/escape literals (values and identifiers might have different syntax for this) you're good. It is risky, like all programming, to take matters into your own hands, but so is using a library you can't understand. Good luck.
- ScottBurson 12y agoCLSQL does the escaping itself. The question is whether a library that does prepared statements is reasonably expected to be safer than one that does escaping. I haven't audited CLSQL's escaping myself, however. And I concede that using prepared statements takes one possible vulnerability off the table, which is nice. I was just wondering whether 'eudox had any specific reason to think that CLSQL's escaping was flawed.