Re: SQL Injection Basics

[Dejan Bosanac <dejanb () datagate co yu>]

The only issue with prepared statements is that if you use them, you 
lose compatibility with different database systems.

Regards,
Dejan

Robert Nilsen wrote:
> I might be missing the point here (and surely it must have been
> posted/explained before), but in my world, the safest way to do SQL is
> through prepared statements, a.k.a. bind variables/paramenters whenever
> someone out in the client segment has "touched" the input. Rule number one
> must always be to never thrust the client! And being sloppy just once with
> validation could mean the end of your data = not putting focus on security!
> By using prepared statements, the code is safer AND, in most cases, the next
> run will execute quicker.
>
> -Robert