Re: [SECURITY] DoS attack on backend possible

On Mon, 19 Aug 2002 ngpg(at)grymmjack(dot)com wrote:

> $input = "user'name";
> INSERT INTO db (name) VALUES ('$input');
>
> will fail because the ' in the input needs to be escaped with a
> backslash.

It will fail because you're doing this a very, very, very bad way.
Why rewrite this kind of stuff when the vendor has already made
correct code available?

PreparedStatement stmt = connection.prepareStatement(
"INSERT INTO db (name) VALUES (?)");
stmt.setString("user'name");
stmt.execute();

cjs
--
Curt Sampson <cjs(at)cynic(dot)net> +81 90 7737 2974 http://www.netbsd.org
Don't you know, in this new Dark Age, we're all light. --XTC