14 Years of SQL Injection and still the most dangerous vulnerability

Re:14 Years of SQL Injection and still the most dangerous vu... by troels on Thursday August 22, 2013 @05:15PM (#6260138)

In a typical loosely typed language, such as php et al., just keep the query and the data separate. E.g.:

    $params = array();
    $sql = "select * from foobars where 1";
    if (isset($_GET['name'])) {
      $sql .= " and name = :name"
      $params[':name'] = $_GET['name'];
    }
    $stmt = $db->prepare($sql);
    $stmt->execute($params);

[ Parent | on HN ]

There are no comments on this comment yet.