News for hackers. Stuff that matters.

A comment on Password may not contain: select, insert, update, delete, drop. Parent comment

Re:Password may not contain: select, insert, update, delete,... by dylan604 on Sunday January 21, 2024 @09:32AM (#39078756)
That’s a comment that makes me think someone read a blog 15 years ago, and never kept up with modern ways of doing things.
[ Parent | on HN ]
Re:Password may not contain: select, insert, update, delete,... by hobs on Sunday January 21, 2024 @01:19PM (#39081056)
Cool - but neither of your comments addressed that I am still correct afaict, if you care about query plans and such parameterization is important, but not getting injected on is a different problem.
[ Parent | on HN ]
Re:Password may not contain: select, insert, update, delete,... by dylan604 on Sunday January 21, 2024 @01:47PM (#39081477)
look, if you still want to live like it's 1999, then sure, go ahead and wrap your params in quotes like you think you can. just don't come crying to the rest of us that have more than once provided you with better solutions when you get attacked. i mean, even using the old style escape methods would be better than your appending of quotes idea.
[ Parent | on HN ]
Re:Password may not contain: select, insert, update, delete,... by hobs on Monday January 22, 2024 @09:12AM (#39089701)
I didn't say I don't use parameterization, and I still haven't heard what the difference is between the old style escape methods and the quotes I mentioned, just you being salty :)
[ Parent | on HN ]