Preventing SQL Injection

Posted on 16th Feb 2014 07:03 pm by admin

I have a question about SQL Injection, In some of our code we use this: view plaincopy to clipboardprint?Replace(inString, "'", "''") Replace(inString, "'", "''") does this prevent all forms of SQL Injection? Also what exactly does parameterized statements do?view plaincopy to clipboardprint?myCommand.Parameters.AddWithValue("@username", user); myCommand.Parameters.AddWithValue("@password", pass);

Your Answer:

Login to answer

Other forums

Can't seem to capture a variable in a chained select
I'm *this* close to having a chained select running but for some reason it doesn't seem to be pickin

please help me in this update statment
hi every one

if I have table and this data in it

id name
10

Using CSS to format MySQL query
Hi,

If i want to have a news page on my site, which displays all records of a table in descen

do while...woes
I'm sure this is childsplay but it is stumping me, everytime i try what I think would make this work

Stumped by Third Day of Month problem
I am trying to build an algorithm that will essentially do this:
Code: [Select]$this_month = Oct

printing links
Hi every1

i am connecting to a table in sql and the looping through with a while ($ var = my

Database connection failure
Hello All,

I am trying to create new connection to Oracle DB 10.1,
I could not see a

Can't find the problem (no error message)!
OK, here's the deal. This code is really weirdly formatted (sorry!) and hard to understand, so I'm g

Calling a Procedure with IN & OUT Parameters
Hello,

I usually call my procedures using the following way

declare variable e

Could Someone Please Debug This?
I was wondering if someone could debug this script for me. I realize it's not the tidest script (and