Eliminating the problem
Posted Jun 1, 2006 15:12 UTC (Thu) by iabervon
In reply to: Eliminating the problem
Parent article: SQL injection vulnerabilities in PostgreSQL
My version is using a prepared statement. My SQLBuffer contains a StringBuffer and a List, and SQLBuffer.add() appends a "?" to the buffer, and adds the argument to its list, which it goes through in fill() using the loop that you omitted from the end of your example. My version is really identical to yours, except that my SQLBuffer methods abstract the pattern that you're open-coding (and, therefore, it's harder to screw up).
to post comments)