Re: Re: SQL injection & prepared statements
| From: | Gerard Samuel | Date: | Fri, 25 Jun 2004 17:29:08 +0000 |
| Subject: | Re: Re: SQL injection & prepared statements | ||
| References: | 1 2 | Groups: | php.db |
| Request: | Send a blank email to php-db+get-34964@lists.php.net to get a copy of this message | ||
On Friday 25 June 2004 01:03 pm, Hans_L wrote:
> Gerard Samuel wrote:
> <snip>
>
> > So Im guessing that this is how "prepared" statements are done on other
> > databases.
> >
> > After being trained to do it one way (always escaping "bad" content), Im
> > being shown to do it the other way, and Im looking for any suggestions
> > you may have.
>
> Yes, the idea with prepared statements is that the database (or
> transport layer, etc.) knows how to properly escape the values.
Thanks for your reply. I wasn't sure who was respondsible for "cleaning up"
data sent to the db. So I guess Ill continue with the thought that
prepared statements (in databases that can use it) takes care of it.
Thanks