Skip to Content.
Sympa Menu

freetds - Re: [freetds] Prepared statement + date fields

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "James K. Lowden" <jklowden AT freetds.org>
  • To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] Prepared statement + date fields
  • Date: Fri, 2 Jun 2006 08:36:39 -0400

KERTEL - Maxime MARAIS wrote:
> I do not use OBDC as I can't find free open source driver for MS-SQL
> uneder Linux (except FreeTDS). Other solutions exist (like ODBC to ODBC
> bridges) but I prefer using as few components as possible.

Well, you won't find an open-source driver for DBD::Sybase except FreeTDS,
either. ;-) No real difference there.

> Finaly, I modified my code and do not use placeholders anymore, even if
> this can be less secure or require more string manipulation in order to
> escape user input and prevent miscallaneous code execution.

I can't think of anyway that using placeholders guards against
miscellaneous code executution.

Better than placeholders, if you have the choice, is to use stored
procedures. You'll avoid the string manipulation in your application, and
centralize your SQL on the server.

HTH.

--jkl




Archive powered by MHonArc 2.6.24.

Top of Page