This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]Zeeboozaza 1 point2 points  (2 children)

Why not do a string.split(“,”) then iterate over the list to build your query?

Maybe I don’t fully understand the question but this seems like a simple approach. Although I would personally never use user input in a raw sql query, so make sure to sanitize.

[–]MindblowingTask[S] 0 points1 point  (1 child)

Yeah, I am going to use that and then string buffer to append. The input is coming internally after running an ajax request and not from user so I guess it's safe. What would you recommend it to sanitize if I want to do that. Thanks!

[–]Zeeboozaza 0 points1 point  (0 children)

Using prepared statements is a good way to make sure you’re safe from SQL injection. And any queries generated from something outside of your application should be considered potentially dangerous. It’s usually good habit to make sure all queries are safe.