|
|
Posted by Chung Leong on 11/04/05 22:11
Jerry Stuckle wrote:
> If the incoming value isn't an integer, you don't.
>
> For instance - let's say I want to order 100 widgets. However, in the
> quantity column I mistype "1q00", because of my fat fingers. :-)
Geez. Either I failed to express myself clearly or people have never
heard of defense in-depth. The existence of a mechanism to stop one
type of SQL injection does not imply that data will necessarily reach
it. You put it there so that the code that interacts with the database
isn't dependent on your validation code for safety. That code should,
of course, keep the user from encountering the odd behavior.
Navigation:
[Reply to this message]
|