This Prog.SE question seems like straight from the Daily WTF. The application needs to insert stuff into an SQL Server DB, but uses a “custom sync process”. The obvious solution is mash the data into a string and stuff it along with the query into SQLite. Another program reads the queries from there, parses the arguments via
string.split()
, and inserts them into SQL Server. No chance of SQL injection, because of parameterized queries. Suure :/