Re:Finding an authorization bypass on my own website
by tus666 on Saturday March 05, 2022 @11:43PM
(#30575090)
Of course there is. If the parameters are incorporated server side after the SQL is parsed then you have true parameterized queries. If the parameters are inserted before the SQL is parsed you have trouble.
[ Parent
| on HN ]
Re:Finding an authorization bypass on my own website
by tomnipotent on Saturday March 05, 2022 @11:53PM
(#30575132)
> you have true parameterized queries
In the sense that stored procedures and prepared statements are queries, sure. But your SQL statement and your values are not being sent in the same call to the database.