Hacker News new | ask | show | jobs
by daneel_w 277 days ago
>"Is there a real-world scenario where data sanitization is required where proper data encoding/escaping is not the better solution?"

In context of SQL queries which accept variable input, the only correct approach is to parameterize the queries, never to string-encode the variables. So, yes. But perhaps you implied parameterization as well.

1 comments

Yes, parameterization was implied.