2 years ago, at the end of March
Protecting yourself from sql injection
Posted by pbirnie under technology
- use bind variables
- restrict the rights of your web apps database user - no more rights than necessary (ie. no drop/create)
- in production mode, when a sql error occurs, only show a message such as "an error occured" - not the full sql that was executed
