Dev.to1 min read
Prepared statements in Manticore Search
Imagine you're building a powerful search application. Users type in keywords, and your backend needs to query the Manticore Search database to find matching results. A common (and tempting!) approach is to embed user input directly into your SQL queries. For example, you might filter by a numeric field such as a category or record ID. If the user passes a normal value like 5, the query is SELECT * FROM products WHERE id=5. But what if they pass 1 OR 1=1? The query becomes SELECT * FROM products
Read original on dev.to0
0Related
Hacker News
$500 GPU outperforms Claude Sonnet on coding benchmarks
Discussed on Hacker News with 377 points and 217 comments.
377
217Hacker News
Whistler: Live eBPF Programming from the Common Lisp REPL
Discussed on Hacker News with 115 points and 13 comments.
115
13Hacker News
Anthropic Subprocessor Changes
Discussed on Hacker News with 98 points and 44 comments.
98
44Get the 10 best reads every Sunday
Curated by AI, voted by readers. Free forever.
Liked this? Start your own feed.
Comment
Sign in to join the discussion.
Loading comments…