Using Multi-Byte Characters to Nullify SQL Injection Sanitizing

Re:Using Multi-Byte Characters to Nullify SQL Injection Sani... by icebraining on Sunday June 26, 2016 @07:34AM (#11980365)

At least in Postgres, you can use ANY and pass an array of values. From what I've read, the generated query plan is equivalent.

[ Parent | on HN ]

Re:Using Multi-Byte Characters to Nullify SQL Injection Sani... by masklinn on Sunday June 26, 2016 @09:11AM (#11980609)

> From what I've read, the generated query plan is equivalent.

I believe at one point IN (values) was just sugar for = ANY(ARRAY(values)), don't know if that's still the case.

Still requires that your DB adapter supports array parameters though.

[ Parent | on HN ]

Re:Using Multi-Byte Characters to Nullify SQL Injection Sani... by snuxoll on Sunday June 26, 2016 @12:05PM (#11981340)

Alternatively, you can use a temp table and a join. Not ideal, but still safe from injection and should have roughly the same overhead in the database.

[ Parent | on HN ]