Skip to content
loading...

re: The Fundamentals of Security Every Developer Should Understand VIEW POST

FULL DISCUSSION
 

Regarding prepared statements. Look into what your driver does with them.
Some drivers just concatenate the strings (no protection at all), others do a sanitised concatenation, the best send it to the server to compile and then send the parameters to the server in separate calls (best).

Know what your driver does! Don't assume.

(Also don't rely on this mechanism.. CHECK YOUR INPUTS!)

code of conduct - report abuse