Re: SQL Injection Basics

[Dirk Gomez <dirk () dirkgomez de>]

> I might be missing the point here (and surely it must have been
> posted/explained before), but in my world, the safest way to do SQL is
> through prepared statements, a.k.a. bind variables/paramenters whenever

Of course! Pasting variables into SQL statement will always leave a door wide
open for SQL injection.

It's a bit more work in the very beginning, but once the framework is in place
using bind variables should be straight-forward.

Not only are bind variables safe, but at least for Oracle it is also the only
way to end up with a scalable database-backed web application.