Is it possible for double-escaping to cause harm to the DB?

Posted by waiwai933 on Stack Overflow See other posts from Stack Overflow or by waiwai933
Published on 2010-03-30T01:18:33Z Indexed on 2010/03/30 1:23 UTC
Read the original article Hit count: 478

Filed under:
|

If I accidentally double escape a string, can the DB be harmed?

For the purposes of this question, let's say I'm not using parametrized queries

For example, let's say I get the following input:

bob's bike

And I escape that:

bob\'s bike

But my code is horrible, and escapes it again:

bob\\\'s bike

Now, if I insert that into a DB, the value in the DB will be

bob\'s bike

Which, while is not what I want, won't harm the DB. Is it possible for any input that's double escaped to do something malicious to the DB assuming that I take all other necessary security precautions?

© Stack Overflow or respective owner

Related posts about database

Related posts about database-security