Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I disagree.

See Example 5 in https://www.php.net/manual/en/security.database.sql-injectio...

This is the recommended way to avoid SQL injection, using sprintf...



The article states this as the second bullet point "Use prepared statements with bound variables."

Reading the page I actually think this is pretty good for being language documentation.


So bad docs because they list a way you don't approve of? They do list a number of different ways. They could have used intval() for example 4 because I prefer it but it doesn't take away from the docs or make them bad.

Do you have a method that makes sprintf with d value invalid?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: