Yes. Better yet: if your parameter is numeric (say, a LIMIT), typecast it to an ... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

tptacek on March 22, 2010 | parent | context | favorite | on: Exploiting hard filtered SQL Injections

Yes. Better yet: if your parameter is numeric (say, a LIMIT), typecast it to an integer (to_i, int(), etc).

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact