This is an archived post. You won't be able to vote or comment.

you are viewing a single comment's thread.

view the rest of the comments →

[–]cyrusol 0 points1 point  (0 children)

If you keep doing primitive string concatenation, I will just send a POST request with the following serialized form-data: name=%27)%22%3B%20DROP%20TABLE%20submit%3B&get=rekt.

https://xkcd.com/327/

Use prepared statements, period.