|
Again, bullshit. The difference between executing a query and parsing a query into a resource and sending the resource to the SQL engine, is mostly an efficiency mechanism. If it will run as a query, it will parse in the query parser. There may be protections in the various SQL engines used, i.e. ensuring a query is readonly, but any time there is the inclusion of user submitted data, there is the possibility of a SQL injection. That's why you have to ALWAYS validate data submitted by users. And, of course, double-check the limits on the data_base_ user running the _script_/application. If it has SELECT only access, a hacker can inject the string with as many UPDATE, INSERT and DELETE attempts as he wants
|