Comment on Two Active Record SQL Injection Vulnerabilities Affecting PostgreSQLparentComments−X-Istence12yOP said: > Prepared statements with bind variables only work when the SQL string is static and only the variables change This is wrong.−simonw12yI said "All ORMs build at least some of their SQL using string concatenation"The "at least some" was meant to imply that they also use bind variables.
Comments
OP said:
This is wrong.I said "All ORMs build at least some of their SQL using string concatenation"
The "at least some" was meant to imply that they also use bind variables.