Preventing SQL Injection


Posted on 16th Feb 2014 07:03 pm by admin

I have a question about SQL Injection, In some of our code we use this: view plaincopy to clipboardprint?Replace(inString, "'", "''") Replace(inString, "'", "''") does this prevent all forms of SQL Injection? Also what exactly does parameterized statements do?view plaincopy to clipboardprint?myCommand.Parameters.AddWithValue("@username", user); myCommand.Parameters.AddWithValue("@password", pass);
No comments posted yet

Your Answer:

Login to answer
202 Like 50 Dislike
Previous forums Next forums
Other forums

Connection Timeout
I'm using xmii 12.0

I'm calling a transaction as a web service from a windows application

Not adding to db
Hi, I can't figure out why it won't add the record to the database. It's just a simple form to get

Problem Dereferencing
With these types and tables:

CREATE TYPE MANAGER AS OBJECT (
MGR_ID INTEGER,

PHP / MySQL Associative Multidimensional Array:
Hello.

I have data in a MySQL Table that adheres to the below: (note, no index, could add if

FPDF Help
I've been playing with the FPDF module. I was building a form and rolling right along and then sudde

help retrieiving results and doing pagination
Having some trouble trying to get the results to show on more than just one page.

What is ha

difference between datetimes
($row['totime']-$row['fromtime'])/60

this is giving me 0

example of totime and fromtim

Having a problem get the selected item from a drop down menu
I have been looking at this for days now.

I have a drop down menu that get it's values from a

Add_Months not Easy to Understand
Oracle is number 1, very fast and very easy. But....
OK, I think but have a problem, only 1 pro

adding 0 to numbers
Hey guys i need to create a 00001 number in a loop. Is there a better way of forcing a 5 digit numbe

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash