|
|
Posted by masterGaurav on 11/19/06 11:46
This is definitely a way to do the things quickly and with less code.
However, I, personally, would suggest not to directly map against
database tables.
If so, do some encoding on it. The reason is obvious. If you are not
checking against the actual fields in the database, SQL-Injection may
be possible by custom-data creation.
What if I hand-craft the data and send it. If you blindly execute the
SQL against the names / values from the forms... things may be
problematic.
Can't give an example for keys being SQL-injected... but I think that
should very much be possible.
--
Cheers,
Gaurav Vaish
http://mastergaurav.org
---------------------------
Navigation:
[Reply to this message]
|