Re:Finding an authorization bypass on my own website
by mirekrusin on Sunday March 06, 2022 @01:35AM
(#30575532)
You can do it right with ie. combinators [0] where you explicitly specify at which position you are in (value, identifier etc) and have much more control over query building (dynamism and flexibility that value-only parametrized query/prepared statement doesn't provide). Tagged templates are fantastic to represent safe query mini-"dsl".
[0] https://github.com/appliedblockchain/tsql/