Prepared statements are the way to go.
Prepared statements aren't strictly speaking the solution; the solution are bind variables which you have to use together with prepared statements.
When you call the DB API that fills values into the bind variables in a prepared statement, the API never concatenates strings, nor interprets the variable values as parts ...
It seems like you've not covered your bases.
For the sake of example, let's say your application has two features: logging in and blogging. You'd expect your setup to be something like:
| | | |
| Login | | Blogging |
| | | |
Treat all user input as suspect. Always.
User input (esp in string format) is always suspect. SQL injection (executed at the time of posting or, as in your question later) is only one way that a malicious user could take advantage of security holes.
Another threat to consider is script injection. (wikipedia)
Using a script injection vulnerability, an ...
From working with Hibernate over the years, one thing I would add about Hibernate vs JDBC is that with big databases, developers tend to make too many mappings, mapping every table in existence when their application only interacts with a small number of them. On it's own, that's not a huge problem. But, when Hibernate gets misused, such practices can bring ...
You did not specify how hard the "not guessable" requirement is. Of course you would not use simple serial numbers, but I would not rule out a mechanism that can create unique strings using simple cryptographic techniques and does not need a database at all.
What are the IDs used for? Just identification of an item? Or are they ...
Your approach is fine. Only using a new table for each year is debatable, this will trade insertion speed for query speed (you will have to query then multiple tables to make sure your uniqueness requirement is fulfilled), so it is not inherently clear if this will really bring the benefit you expect from it.
I would actually keep away from this premature ...
Don't use option 2. It's always a recipe for disaster when people get the idea "hey, if I store things here as text, I can do all kinds of things and the database can't prevent me from shooting myself in the foot".
So you're trying to store the whole state of the graph at a given time. In that case option 1 would work. While an asset doesn't have a direct ...
In the past, when I needed this capability, I employed a Generic Key strategy. It looks like this:
Generic Key Type Table
GenericKeyTypeID TableName FieldName
1 Table1 FlagID
2 Table2 FlagID
3 Table3 FlagID
You can have as many combinations of table and field in your Generic Key ...