[erlang-questions] Of regexes and REs, and other irritating things...

[PAILLEAU Eric]

I agree .

Note, what I like in Postgresql on contrary of Mysql, is the dollar quoting.

In addition to usual SQL injection protections on data input,
you can also use dynamic dollar quoting, to make more complexe SQL 
injection attempts :

UPDATE users set password=$4896$new password hash$4896$ WHERE id=12345 ;

4896 is for instance the PID of the forked Apache process, or anything 
else with more entropy.

The attacker can't guess this ID and injection is much much more complex...


Le 11/08/2014 09:51, Loïc Hoguin a écrit :
> On 08/11/2014 06:02 AM, Mike Oxford wrote:
>> I need to so some input sanitizing for use against MySQL.
>
> Are you saying you are going to take this data and put it inside a query
> string? This isn't going to protect anything, escaping doesn't prevent
> SQL injection. Why not use a prepared statement instead? This makes the
> data separate from the query, you don't need to do any escaping and
> MySQL takes care of everything for you. Also make sure you are using the
> *binary* protocol, not the *text* one, and you're pretty much set.
>