Forum OpenACS Q&A: Re: Anti SQL Injection Example (Link)

Collapse
Posted by Dirk Gomez on
The Oracle version of OpenACS uses bind variables and is not vulnerable to SQL injection attacks: the reason is that the SQL is parsed without *any* user input at all.

Can someone explain how this works in the PostgreSQL version?

Collapse
Posted by Malte Sussdorff on
To my knowledge exactly the same way.