Skip to Content.
Sympa Menu

freetds - Re: [freetds] Prepared statement + date fields

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "James K. Lowden" <jklowden AT freetds.org>
  • To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] Prepared statement + date fields
  • Date: Fri, 2 Jun 2006 20:00:32 -0400

Bort, Paul wrote:
> > I can't think of anyway that using placeholders guards against
> > miscellaneous code executution.
> >
>
> I think that the binding process automatically handles escaping single
> quotes, so it stops SQL injection attacks.

I should have had my coffee first. :-/

You mean e.g.:

SELECT * FROM authors
WHERE id = ?

can't become:

SELECT * FROM authors
WHERE id = (select min(id) from authors)

?

I don't happend to code in environments where "attacks" are a worry, so I
don't usually think about such things.

Regards,

--jkl




Archive powered by MHonArc 2.6.24.

Top of Page