Avoiding SQL Injection using Parameters
SQL injection can be avoided by using Parameters is a well known fact. I just want a detailed idea of how it works. Thanks in Advance.
Loading
Know the answer? Post it — somebody with the same question will find it here.
Sign in to answer this question
It is the same account you read, post and publish with — and you will come straight back to this page.
VulpesPosted Sep 15, 2014, 6:04 PM
It already knows what the query is going to do and that the parameters are just placeholders for data, not SQL commands. Consequently, there is no chance that when the actual data is inserted it will change the nature of the query and, since it also knows the type of the data, any mismatch will be immediately detected and an error flagged up.
Murugesh PPosted Sep 17, 2014, 3:22 AM