Skip to main content
Software Engineering

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

17
  • 1
    Not all DBMS support parameter for table name. Commented Dec 20, 2022 at 10:25
  • 12
    I misread this answer the first time and now I really want a Code Bear plush. Commented Dec 20, 2022 at 11:38
  • 1
    "Unsanitized" isn't quite right, because that's isn't precisely what parameterized queries do. That is, parameterized queries don't escape the input data to make it safe. Rather, they keep the input data separate from query data completely. "Unisolated" or "unquarantined" is probably a better way to phrase it. Commented Dec 21, 2022 at 21:34
  • 1
    @JoelCoehoorn: I spoke of unsanitized data especially in the context of dynamic queries, not parametrized queries. When you need to create a dynamic query and cannot use a parametrized one, you have to sanitize the data, not to "isolate" it. Commented Dec 21, 2022 at 21:36
  • 1
    @BeniCherniavsky-Paskin: my answer isn't intended to explain all the gory details of correct, incorrect, safe, and unsafe dynamic SQL. For this, we have Stackoverflow and Codereview.SE. Commented Dec 22, 2022 at 6:36