As I was teaching students how to prevent SQL injection today, I was mildly embarrassed. In professional projects I've used prepared statements / parameterized queries as one layer of prevention against SQL injection (although I've never used mySQL professionally). In theory, I thought SQL injection was impossible when using a prepared statement.As I was teaching students how to prevent SQL i
阅读背景：
为什么MySQLI预处理语句允许SQL注入？
来源：互联网
分享到：
