Or maybe introduce them to Little Bobby Tables

(skeletor is leading by example by adding that unnecessary apostrophe...)

You're viewing a single thread.

180 comments

'; DROP TABLE `passwords`; --
- My bank doesn't allow the characters you would need for a SQL injection in passwords. Checked client side, I don't want to try and find out if it's also checked server side, but I hope it is.
  
  No serious software would fall for such an easy attack anymore. With prepared statements it's impossible to break queries like that. Beside that one principle is to avoid using user inputs directly in your database.
- Good way to punish websites that have zero security i suppose

You've viewed 180 comments.