Re:A Big Case of Oops
by fendale on Friday February 26, 2010 @12:14PM
(#1153562)
Exactly correct - and if you are using Oracle and not using parameterised queries (known as bind variables in the Oracle world), you are quickly going to have performance problems too. That's not the case with MYSQL as it doesn't have a cursor cache in the same way Oracle has. I have no idea about Postgres or SQLServer.
A rule of thumb is that if you are concatenting user input strings into your SQL query strings you are doing it wrong.
Re:A Big Case of Oops
by tptacek on Friday February 26, 2010 @01:28PM
(#1153752)
Remember that parameterized queries aren't a panacea. There are plenty of things that don't parameterize well, such as table names, sort orders, and limits.
A rule of thumb is that if you are concatenting user input strings into your SQL query strings you are doing it wrong.