How can prepared statements protect from SQL injection attacks?

前端 未结 9 2037
予麋鹿
予麋鹿 2020-11-21 05:40

How do prepared statements help us prevent SQL injection attacks?

Wikipedia says:

Prepared statements are resilient against SQL injection, because

9条回答
  •  执笔经年
    2020-11-21 06:07

    When you create and send a prepared statement to the DBMS, it's stored as the SQL query for execution.

    You later bind your data to the query such that the DBMS uses that data as the query parameters for execution (parameterization). The DBMS doesn't use the data you bind as a supplemental to the already compiled SQL query; it's simply the data.

    This means it's fundamentally impossible to perform SQL injection using prepared statements. The very nature of prepared statements and their relationship with the DBMS prevents this.

提交回复
热议问题