Exploiting 'INSERT INTO' SQL Injections Ninja Style

Re:Exploiting 'INSERT INTO' SQL Injections Ninja Style by rick888 on Friday October 28, 2011 @04:39PM (#3169974)

I thought they were phasing these functions out (mysql)? I've been using PDO for the last couple of years.

[ Parent | on HN ]

Re:Exploiting 'INSERT INTO' SQL Injections Ninja Style by troels on Friday October 28, 2011 @07:06PM (#3170446)

The problem is not which driver you use. It's whether you concatenate strings to form sql queries and then execute them against your database.

[ Parent | on HN ]

Re:Exploiting 'INSERT INTO' SQL Injections Ninja Style by JoeCortopassi on Friday October 28, 2011 @07:17PM (#3170481)

I think the point he was trying to make, was that using prepared statements with PDO or mysqli would prevent this

[ Parent | on HN ]

Re:Exploiting 'INSERT INTO' SQL Injections Ninja Style by rick888 on Friday October 28, 2011 @11:38PM (#3171021)

exactly.

[ Parent | on HN ]