I am now learning about sql injections and I know that the solution to avoid them is prepared statements. However, does this mean that without them we are sure that we can get hacked? Are prepared statements the only solution? I was thinking about that and I have decided to write a piece of code ...
And yes, shamelessly self-promoting my answer, because your ability to make a secure query with escaping once does not mean that you will remember to do it correctly everytime:
tl/dr: The ability to properly escape user input once does not mean
your company will do it every time. You can't. Don't even try.
You have 2 good answers for the specific question you asked. However, I wanted to touch on some broader issues that are very important here:
Prepared statements ar...
tl/dr: The ability to properly escape user input once does not mean
your company will do it every time. You can't. Don't even try.
You have 2 good answers for the specific question you asked. However, I wanted to touch on some broader issues that are very important here:
Prepared statements ar...
