What are the books banned in camp Guantanamo?

Re:What are the books banned in camp Guantanamo? by throwanem on Sunday January 15, 2017 @07:30AM (#13403713)

Badly written SQL generation often prompts single quotes being forbidden in input. "Having single quotes there breaks my queries," one sometimes hears said. "I don't know why."

This is a great opportunity to mentor one's juniors. An injection attack is trivial to demonstrate in the local dev environment, and the result strongly motivates anyone worth working with to learn how not to do that again.

[ Parent | on HN ]

Re:What are the books banned in camp Guantanamo? by projektfu on Sunday January 15, 2017 @08:11AM (#13403801)

For the 10,000 who might be learning about this today, the answer is prepared statements with placeholders for the values, like this pseudocode:

   stmt = driver.prepare("insert into names 
      (firstname, lastname) values (?, ?)");
   stmt.execute("Flannery", "O'Connor");

Syntax varies among database interfaces but this ensures that any odd strings are properly stored by the driver and the application does not need to worry about them. There is also no risk of someone rewriting the SQL statement.

[ Parent | on HN ]