Quote:
Originally Posted by Damien
Don't think they are. Admittedly .Net has the best support for it I have yet seen. They are usually handled via database abstraction layers depending on the database outside of a .Net stack. I think PHP has had it since PHP 5. Although you seem to need a newer version of mySQL. Worth it though. Parametrised Queries rock.
http://www.php.net/manual/en/mysqli-stmt.bind-param.php |
Admittedly I don't use MySQLi extensions but it doesn't actually say in that doc that it santises input like ASP.NET. So it might just be a glorifed String.Format function.
Speaking of data abstraction ZendFramework does santise input via factory queries but it shouldn't be assumed they all do.