Dynamic SQL Is Not Inline SQL
Posted by: youve been HAACKED,
on 02 Nov 2005 |
View original
Perhaps there is a better term I could be using when I referred to dynamic SQL in my last post. To my defense, I did mention using Prepared Statements.
The key point to keep in mind while reading the last post is that Dynamic SQL does not necessarily imply Inline SQL. By inline SQL, I mean concatenated sql statements flung all over the code like a first year classic ASP developer.
Like any good security minded developer, I detest inline SQL (as I define it here). A much better and safer approach...