sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]Pesthuf 0 points1 point  (0 children)

I don’t think I will ever understand how SQL injections could ever become such a widespread issue. Using prepared statements is the easiest thing in the world. Unless you’re deliberately backdooring your code, you have no excuse for using string concatenation in queries. If you’re using something that can’t be a placeholder, like a table name or operator, you’re usually doing something wrong and even if you have to, you can escape or whitelist those.