News for hackers. Stuff that matters.

A comment on Exploiting 'INSERT INTO' SQL Injections Ninja Style. Parent comment

Re:Exploiting 'INSERT INTO' SQL Injections Ninja Style by troels on Friday October 28, 2011 @07:06PM (#3170446)
The problem is not which driver you use. It's whether you concatenate strings to form sql queries and then execute them against your database.
[ Parent | on HN ]
Re:Exploiting 'INSERT INTO' SQL Injections Ninja Style by JoeCortopassi on Friday October 28, 2011 @07:17PM (#3170481)
I think the point he was trying to make, was that using prepared statements with PDO or mysqli would prevent this
[ Parent | on HN ]
Re:Exploiting 'INSERT INTO' SQL Injections Ninja Style by rick888 on Friday October 28, 2011 @11:38PM (#3171021)
exactly.
[ Parent | on HN ]