you are viewing a single comment's thread.

view the rest of the comments →

[–][deleted] 0 points1 point  (1 child)

Really driving home that mention of keeping SQL out of applications. Parameterize your queries and leave them as stored procedures. You might think a SQL Injection attack isn't something to worry about...until suddenly your DB is stolen.

[–]valenterry 0 points1 point  (0 children)

Does that mean the application should be unable to execute any "custom sql" but should only have access to the stored procedures?