News for hackers. Stuff that matters.

A comment on Web Developer Security Checklist. Parent comment

Re:Web Developer Security Checklist by adamzochowski on Tuesday May 16, 2017 @10:19AM (#14349753)
I am not the original poster, but some queries can't be moved to stored procedures (depends on SQL software and library abilities). For example:

IN clauses can get tricky if prepared statements don't support arrays / lists of columns.

Adhoc queries get tricky where user could specify a parameter or not.

This answer is more about stored procedures than prepared statements.

[ Parent | on HN ]
Re:Web Developer Security Checklist by aeronautic on Tuesday May 16, 2017 @10:35AM (#14349870)
That is right. The key point is to reduce exposure to SQL injection by not formatting queries. Prepared statements help solve a whole class of bugs at a lower level.
[ Parent | on HN ]