Is it possible for double-escaping to cause harm to the DB?
Posted
by waiwai933
on Stack Overflow
See other posts from Stack Overflow
or by waiwai933
Published on 2010-03-30T01:18:33Z
Indexed on
2010/03/30
1:23 UTC
Read the original article
Hit count: 478
database
|database-security
If I accidentally double escape a string, can the DB be harmed?
For the purposes of this question, let's say I'm not using parametrized queries
For example, let's say I get the following input:
bob's bike
And I escape that:
bob\'s bike
But my code is horrible, and escapes it again:
bob\\\'s bike
Now, if I insert that into a DB, the value in the DB will be
bob\'s bike
Which, while is not what I want, won't harm the DB. Is it possible for any input that's double escaped to do something malicious to the DB assuming that I take all other necessary security precautions?
© Stack Overflow or respective owner