Defending against SQL injection? #57

Activity

1. kkaefer commented on Jan 21, 2012

   

   kkaefer

   on Jan 21, 2012

   Contributor

   More actions

   SQLite protects you against SQL injections if you specify user-supplied data as part of the params rather than stringing together an SQL query:

   BAD: db.prepare("INSERT INTO foo VALUES(" + variable + ")");

   GOOD: db.prepare("INSERT INTO foo VALUES (?)", variable);

   By using the placeholder ?, SQLite automatically treats the data as input data and it does not interfere with parsing the actual SQL statement.

   👍React with 👍12Reacted by albertLuth, Vic, Lewis Pham, Americrypt™, edfus, Rain, Christoph Pahmeyer, Diego Parreira, Sérgio Gabriel, ArtInLines and 2 more
2. kkaefer

   closed this as completedon Jan 21, 2012
3. cmundi commented on Jan 21, 2012

   

   cmundi

   on Jan 21, 2012

   Author

   More actions

   Thanks. I hoped so. I did not want to assume that "prepare" in
   node-sqlite3 means thevsamw thing as sqlite3_prepare in the sqlite libs. I
   should stop being lazy and just look at the source. :) Thanks!
   On Jan 21, 2012 3:08 AM, "Konstantin Kfer" <
   reply@reply.github.com>
   wrote:

   SQLite protects you against SQL injections if you specify user-supplied
   data as part of the params rather than stringing together an SQL query:

   BAD: db.prepare("INSERT INTO foo VALUES(" + variable + ")");

   GOOD: `db.prepare("INSERT INTO foo VALUES (?)", variable);

   By using the placeholder ?, SQLite automatically treats the data as
   input data and it does not interfere with parsing the actual SQL statement.

   ---

   Reply to this email directly or view it on GitHub:

   #57 (comment)
4. Efreak

   added a commit that references this issue on Jun 10, 2014

   Sanitize SQL

   ...

   2abe8f7
5. AnnAddicks

   added a commit that references this issue on Aug 9, 2017

   Switch string concatenation to placeholders.

   ...

   7f6b343
6. StevenSong

   added a commit that references this issue on Jan 30, 2019

   cleanup

   ...

   6b83f2a