Comment Comment by _jhqp > why the SQL API even allows injection vulnerabilityHow would one implement this?"SQL APIs" use prepared statements. Meaning you have a string for SQL and some dynamic variables that inject into that string via $1, $2 etc.BUT now if developer makes that string dynamic via a variable, then you have SQL injection again. parent _jhqp 2 years ago
How would one implement this?
"SQL APIs" use prepared statements. Meaning you have a string for SQL and some dynamic variables that inject into that string via $1, $2 etc.
BUT now if developer makes that string dynamic via a variable, then you have SQL injection again.