Re:No-SQL injection in Mongo PHP
by btilly on Wednesday March 09, 2011 @12:15AM
(#2303929)
Oops, I had misunderstood. You're right. It makes no sense to bind table names as parameters, because if you do then the database really has no information from which it can generate possible query plans from.
The way that I solved that particular problem in the past is that I used a templating system to generate my SQL. User input was allowed in ifs in my templates, and as parameters for my queries, and that was it. At no point did I trust user data inside of my SQL.
The way that I solved that particular problem in the past is that I used a templating system to generate my SQL. User input was allowed in ifs in my templates, and as parameters for my queries, and that was it. At no point did I trust user data inside of my SQL.