So...if I naively parameterize the inputs for my queries (select blah, blah, blah FROM customers WHERE id LIKE @id) and have the incoming request just check for an id parameter and make a SQL parameter named @id, with value = whatever the input is, am I 90% there?
Or are there still vulns/exploits for that kind of usage?
Or are there still vulns/exploits for that kind of usage?