News for hackers. Stuff that matters.

A comment on From SQL injection to shell: PostgreSQL edition.

Re:From SQL injection to shell: PostgreSQL edition by herge on Sunday December 09, 2012 @12:41PM (#4895268)
If I use sql parameters in my queries, am I still vulnerable to SQL injection? What about using a (sane) ORM?

Basically, is it only php apps that hand-build queries that are vulnerable to SQL injection?

[ Parent | on HN ]
Re:From SQL injection to shell: PostgreSQL edition by jasonlotito on Sunday December 09, 2012 @12:55PM (#4895323)
Any app that hand-builds queries. PHP has nothing to do with this. Just happens to be the vehicle. The problem is simply insecure patterns.
[ Parent | on HN ]