News for hackers. Stuff that matters.

A comment on Using Multi-Byte Characters to Nullify SQL Injection Sanitizing. Parent comment

Re:Using Multi-Byte Characters to Nullify SQL Injection Sani... by masklinn on Sunday June 26, 2016 @09:11AM (#11980609)
> From what I've read, the generated query plan is equivalent.

I believe at one point IN (values) was just sugar for = ANY(ARRAY(values)), don't know if that's still the case.

Still requires that your DB adapter supports array parameters though.

[ Parent | on HN ]
Re:Using Multi-Byte Characters to Nullify SQL Injection Sani... by snuxoll on Sunday June 26, 2016 @12:05PM (#11981340)
Alternatively, you can use a temp table and a join. Not ideal, but still safe from injection and should have roughly the same overhead in the database.
[ Parent | on HN ]