News for hackers. Stuff that matters.

A comment on Using Multi-Byte Characters to Nullify SQL Injection Sanitizing. Parent comment

Re:Using Multi-Byte Characters to Nullify SQL Injection Sani... by tbrownaw on Sunday June 26, 2016 @11:38AM (#11981217)
That's when you combine parameterized queries and concatenated SQL:

    sql = '... col_name IN ('
    foreach(var arg in args)
      if (!first)
        sql.append(', ')
      sql.append('?')
      params.add(arg)
    sql.append(')')
[ Parent | on HN ]

There are no comments on this comment yet.