Re:How boring should your team be
by eurasiantiger on Monday October 17, 2022 @07:00AM
(#33231909)
It is only safe for the SQL server. An injection attack could still be targeting a cache (to poison it with e.g. a malicious script), the browser (to steal data via XSS/CSRF) or the user (show an error message telling them to contact malicious number).
Re:How boring should your team be
by P5fRxh5kUvp2th on Monday October 17, 2022 @08:38AM
(#33232671)
What the person said
> "You can stick any user input into a database query and you'll be fine"
Besides which, pretend SQL Server is a glorified cache, the result is the same.
Fundamentally it's mixing data and executable code such that the DBMS cannot properly distinguish between the two and can inadvertently treat data as executable code.
Parameterize queries very explicitly tells the DBMS "this is executable code, and this over here is data". Nothing anyone puts in the data will ever be mistake as executable code by the DBMS. THIS IS SAFE.