Timeline for Why did SQL injection prevention mechanism evolve into the direction of using parameterized queries?
Current License: CC BY-SA 4.0
2 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 16, 2023 at 21:05 | comment | added | Simon Geard | Indeed... SQL injection (and command injection, etc) are all essentially the same thing as XSS... variants on the theme of serializing a complex structure into a byte stream and reading it back again. If you construct that byte stream using the right tools, it all works... but if you take shortcuts, things can go very very wrong. Escaping can work, and is sometimes the only option, but you need to handle the encoding exactly the same as what the parser expects. | |
| Apr 14, 2023 at 17:56 | history | answered | gnasher729 | CC BY-SA 4.0 |