Hacker News Reader

This is why in my new project I decided to use prepared statements wherever possible, it seemed like simply the best choice because sanitizing is never perfect. Here's the article that convinced me in case anybody else wants to read: https://kevinsmith.io/sanitize-your-inputs/

View on HN

This is absolutely the best mitigation for SQL injection.

It can also speed up your queries as it allows better caching of the query plan.

It always annoys me when SAST products on detecting injection advise using better input validation. No! Use parameterised queries and be done with it.

Input validation is more general and helps mitigate other types of vulnerabilities, such as overflows and other injection attacks.

I'm all for defence in depth, and agreed there are many other types of injection attack this doesn't mitigate.

Until someone wants to do something slightly different, can't figure out how to make it work because they've tried nothing and are all out of ideas - so they just use string concatenation and execute the string dynamically. Ask me how I know.

Reply on news.ycombinator.com