Skip to main content
Software Engineering

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

16
  • 21
    Your code would immediately break the moment someone makes a status that uses the " character. Commented Mar 7, 2023 at 11:34
  • 35
    Programming involves wrangling complexity, more complexity than we can reliably track. Thus, we create abstractions and tools to hide and automate parts. We program defensively, not just to guard against unexpected inputs but to guard against our own fallibility. It is possible to use query interpolation correctly, but it is easy to accidentally mess up. Thus, we prefer fixed query strings or parametrized queries whenever possible. Similarly, it is possible to write secure code in C, but it's easy to accidentally make grave errors. Thus, we prefer memory-safe languages like Python. Commented Mar 7, 2023 at 13:03
  • 61
    As a data scientist my threat model of SQL injection attacks consists entirely of my own stupidity and ignorance. That is not a trivial threat. Commented Mar 7, 2023 at 15:24
  • 27
    Community, if someone asks a question about a bad idea which inspires good answers, the question deserves upvotes, not downvotes, regardless how bad the idea is. Commented Mar 7, 2023 at 18:15
  • 13
    You don't need to sanitise input at all. You need to use parametrized queries. Commented Mar 7, 2023 at 21:03