Conversation

Notices

1. Embed this notice
   翠星石 (suiseiseki@freesoftwareextremist.com)'s status on Sunday, 11-May-2025 20:36:27 JST 翠星石

   in reply to

   • Ayo
   @ayo Have you considered just not writing SQL injections?
   
   User inputs always need to go into the SQL assembly function as an argument and not used to build up a string and you're safe.
   • Embed this notice
     Ayo (ayo@lonely.town)'s status on Sunday, 11-May-2025 20:36:29 JST Ayo

     A silly advantage of not using integer keys: when you somehow make the mistake of interpolating the key directly in the SQL statement, string keys will nearly always result in a syntax error even with correct inputs, making SQL injection bugs much harder to miss.

     (Not speaking from experience)