freetds AT lists.ibiblio.org
Subject: FreeTDS Development Group
List archive
- From: "James K. Lowden" <jklowden AT freetds.org>
- To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
- Subject: Re: [freetds] Prepared statement + date fields
- Date: Fri, 2 Jun 2006 20:00:32 -0400
Bort, Paul wrote:
> > I can't think of anyway that using placeholders guards against
> > miscellaneous code executution.
> >
>
> I think that the binding process automatically handles escaping single
> quotes, so it stops SQL injection attacks.
I should have had my coffee first. :-/
You mean e.g.:
SELECT * FROM authors
WHERE id = ?
can't become:
SELECT * FROM authors
WHERE id = (select min(id) from authors)
?
I don't happend to code in environments where "attacks" are a worry, so I
don't usually think about such things.
Regards,
--jkl
-
[freetds] Prepared statement + date fields,
KERTEL - Maxime MARAIS, 06/01/2006
-
Re: [freetds] Prepared statement + date fields,
Frediano Ziglio, 06/02/2006
-
Re: [freetds] Prepared statement + date fields,
KERTEL - Maxime MARAIS, 06/02/2006
- Re: [freetds] Prepared statement + date fields, Frediano Ziglio, 06/02/2006
- Re: [freetds] Prepared statement + date fields, James K. Lowden, 06/02/2006
- Re: [freetds] Prepared statement + date fields, James K. Lowden, 06/02/2006
-
Re: [freetds] Prepared statement + date fields,
KERTEL - Maxime MARAIS, 06/02/2006
- <Possible follow-up(s)>
- Re: [freetds] Prepared statement + date fields, michael . peppler, 06/02/2006
-
Re: [freetds] Prepared statement + date fields,
Bort, Paul, 06/02/2006
- Re: [freetds] Prepared statement + date fields, KERTEL - Maxime MARAIS, 06/02/2006
- Re: [freetds] Prepared statement + date fields, James K. Lowden, 06/02/2006
- Re: [freetds] Prepared statement + date fields, Bort, Paul, 06/05/2006
-
Re: [freetds] Prepared statement + date fields,
Frediano Ziglio, 06/02/2006
Archive powered by MHonArc 2.6.24.