965

submitted 8 months ago by sag@lemm.ee to c/programmer_humor@programming.dev

125 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[-] r00ty@kbin.life 10 points 8 months ago

Well no. If the programmer uses prepared statements, they are protected. If they use a prepared statement but actually just put their own unsanitized statement in there and execute it, it's not protected.

Now, I'd like to say it is 2024 and everyone should be using AT LEAST prepared statements for security. I've seen people doing some scary things in my time, and that includes quite recently.

[-] dan@upvote.au 1 points 8 months ago

Bad developers will do bad things, but most DB framework documentation points people towards the right way to do things, which is why I said it's not common any more.