Six ways to protect yourself from SQL Injection

Re:Six ways to protect yourself from SQL Injection by mooism2 on Tuesday March 29, 2011 @06:48PM (#2384875)

Use placeholders in prepared statements. "Sanitising" your input, banning magic words etc is hacky and fragile by comparison.

[ Parent | on HN ]

Re:Six ways to protect yourself from SQL Injection by MattBearman on Wednesday March 30, 2011 @02:35AM (#2386118)

I said in my article someone would show me a better way and this is it - I'd never seen prepared statements before now, but you can bet I'll be using them from now on.

For anyone else who isn't sure what they are: prepared statements involves sending a template style query and parameters to the SQL api separately, eg:

query template: "select * from users where username = ?"

Parameter: "Matt"

The SQL api knows that one is a query and one is just a parameter so injection is impossible

[ Parent | on HN ]

Re:Six ways to protect yourself from SQL Injection by redredraider on Tuesday March 29, 2011 @07:49PM (#2385060)

I never thought of this. It's good

[ Parent | on HN ]