Hm, even doing SQL parameterization the wrong way (with dumb string joins), it shouldn't be an issue on its own. The real issue is names like O'Connell.
I know, the quotes must be there and will ignore anything inside, but with SQL misuse, you never know! Someone is probably using it in a worse way than any sane person would think possible.
Comments
Hm, even doing SQL parameterization the wrong way (with dumb string joins), it shouldn't be an issue on its own. The real issue is names like O'Connell.
I know, the quotes must be there and will ignore anything inside, but with SQL misuse, you never know! Someone is probably using it in a worse way than any sane person would think possible.