Re:U.S. Election Agency Breached by Hackers After November Vote
by stormbrew on Saturday December 24, 2016 @10:57PM
(#13252823)
It has also been a long time since I've used php, but when I did there were a few problems here.
One is that mysql (opposed to oracle or pgsql) is kind of unusual in allowing quotes indiscriminately for all column types, so in order to do this right you have to only do it for string type columns and prevent injection on different types some other way.
Another is that most of the APIs around the more sprintf-style quoting (eg: `query("SELECT * FROM table WHERE x = %", someStr);`) are tied into prepared statements, which carry their own problems that also differ per engine.
It's actually not as simple as you might think. On top of that, php used to have the whole automatic quoting thing that just made a hash out of things.
One is that mysql (opposed to oracle or pgsql) is kind of unusual in allowing quotes indiscriminately for all column types, so in order to do this right you have to only do it for string type columns and prevent injection on different types some other way.
Another is that most of the APIs around the more sprintf-style quoting (eg: `query("SELECT * FROM table WHERE x = %", someStr);`) are tied into prepared statements, which carry their own problems that also differ per engine.
It's actually not as simple as you might think. On top of that, php used to have the whole automatic quoting thing that just made a hash out of things.