3 ms·
> Because someone wrote an SQL query with string interpolation of variables and no escaping. Why? Because the values at that time were actually coming from a li
by zhte415 11y ago
> Because someone wrote an SQL query with string interpolation of variables and no escaping. Why? Because the values at that time were actually coming from a limited set and were safe to provide that way. Yet I argued that it should be a prepared query anyway, so that we avoid it potentially exploding in the future.
I'm curious if you had coding standards (internally developed, or adopted from another party / standard) that stated best practice?
In my experience, an objective standard is really important in these discussions. If you did, and they wanted to avoid it, was it referred to? If you didn't, was developing a standard taken as a learning point to be adopted in the future, or not pursued?
- viraptor 11y agoIt was a helper script rather than an existing project, so it was in the "unregulated" region It's hard in my experience to have a coding standard that's team-wide, cross-project and doesn't get in the way. But you're right that parametrised queries could be one requirement that you have to keep.