Skip to content

Comment on Two Active Record SQL Injection Vulnerabilities Affecting PostgreSQLparent

Comments

No you can definitely use prepared statements with bind variables since you can dynamically name the bind variables. So if you have a statement where you don't know how many bind variables will go into the query you can give the bind variable a name and add a number at the end that you increment for each additional bind variable (e.g. @param + i for @param1, @param2, @param3, etc.).

Depending on how complex your query is it can get to be a bit of work but it's doable.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.