[HN Gopher] When parameterization fails: SQL injection in Nim us...
       ___________________________________________________________________
        
       When parameterization fails: SQL injection in Nim using
       parameterized queries
        
       Author : xx_ns
       Score  : 11 points
       Date   : 2025-04-02 16:17 UTC (6 hours ago)
        
 (HTM) web link (blog.nns.ee)
 (TXT) w3m dump (blog.nns.ee)
        
       | jiggawatts wrote:
       | That's... not parameterization the way most people understand it.
       | It's text templating, which is different and fraught with risk as
       | the OP discovered.
       | 
       | For comparison: the Microsoft SQL client code will _not_
       | substitute an escaped version of the query parameters into the
       | query text! It sends the query with the named placeholders first,
       | and then the parameter values encoded _separately_ so that
       | there's zero risk of this kind of thing happening.
       | 
       | Also, this makes it trivial for the database engine to cache each
       | query independently of the specific query parameter values.
        
         | inbx0 wrote:
         | Yes. And that is what a client should 100% do from the security
         | standpoint. But since you mention caching - from the perf
         | standpoint, it could sometimes be beneficial for the query
         | planner to know the values before coming up with the query
         | plan. Sometimes I have done little optimizations by replacing
         | prepared statement placeholders with baked-in numbers or known
         | enum values.
        
       ___________________________________________________________________
       (page generated 2025-04-02 23:01 UTC)