Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Abolish the use of parameter escapes completely. #57

Open
SOF3 opened this issue Apr 16, 2021 · 0 comments
Open

Abolish the use of parameter escapes completely. #57

SOF3 opened this issue Apr 16, 2021 · 0 comments

Comments

@SOF3
Copy link
Member

SOF3 commented Apr 16, 2021

Currently, all parameters except MySQL strings are formatted on the main thread and interpolated into the query.

This is dangerous as it increases the risk of SQL injection attacks. Although there is no immediately known impact, this increases the risk in the future and relies on the correct implementation of integer formatting code, which is not guaranteed to be secure.

Furthermore, bound parameters do not need a formatting-parsing roundtrip and is likely to bring better performance for the query sending process.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant