[freetds] Prepared statement + date fields
Bort, Paul
pbort at tmwsystems.com
Mon Jun 5 12:39:51 EDT 2006
> You mean e.g.:
>
> SELECT * FROM authors
> WHERE id = ?
>
> can't become:
>
> SELECT * FROM authors
> WHERE id = (select min(id) from authors)
>
> ?
>
> I don't happend to code in environments where "attacks" are a
> worry, so I
> don't usually think about such things.
>
I mean
SELECT * FROM authors WHERE id = ?
Won't do bad things if the user enters
'; GO; DELETE FROM authors; GO;
as the id (if it's a string), or
0; GO; DELETE FROM authors; GO;
if it's numeric.
But that will ruin your whole day if you're just concatenating strings.
Regards,
Paul
P.S. I don't code in an environment where attacks are a concern today,
but I'm always one firewall away from the outside world, so I like to be
safe, just in case.
More information about the FreeTDS
mailing list