note 120305 deleted from security.database.sql-injection by cmb

Note Submitter: carl at sagan dot com ---- To : jaimthorn at yahoo dot com # My 2 cents: It happens in the real world that users usually want to find text in their databases, so having them all binary coded not only makes it harder find, you spend more money doing database lookups, and your lookups will take forever in large databases. # My suggestion: SANITIZE user input, everything. Cookies, POST, GET, Headers, Files, URLS everything you can. Become the cat lady of software security. Use prepared statements. To: wang dot liang dot com at gmail dot com # My 2 cents: The idea of having two kind of database users could be good for certain purposes, BUT, what you are doing is only reducing the possibility of hacking in half. You STILL need to SECURE the other half of your queries. # My suggestion: SANITIZE user input, everything. Cookies, POST, GET, Headers, Files, URLS everything you can. Become the cat lady of software security. Use prepared statements. ANYONE READING HERE: Don't consider those suggestions please, you are only going to shoot yourself in the foot.