From: Todd Benson <caduceass@...>
Date: 2008-05-31T02:30:59+09:00
Subject: Re: How do i replace actual value in the query with variables?

On Fri, May 30, 2008 at 1:04 AM, KUBO Takehiro <kubo@jiubao.org> wrote:
> This is insecure.
>  http://en.wikipedia.org/wiki/SQL_injection
>
> Good style is:
>  conn.exec( "UPDATE SCH_EVENT SET P_ID = 2444334 where RANK = :1 AND
> playlist_id=432", s)
>
> The most efficient way in performance view is:
> ----------------------------------------------------------------------------------------------------
> cursor = conn.parse( 'UPDATE SCH_EVENT SET P_ID = 2444334 where RANK=
> :1 AND playlist_id=432')
> for q in 0..4
>  s = Float(q)
>  cursor.exec(s)
> end
> cursor.close
> ----------------------------------------------------------------------------------------------------
>
>

How can you not still do insecure injection with this?

Todd