{"id":13098,"date":"2022-10-03T00:28:01","date_gmt":"2022-10-02T18:58:01","guid":{"rendered":"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/"},"modified":"2022-10-03T00:28:01","modified_gmt":"2022-10-02T18:58:01","slug":"solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted","status":"publish","type":"post","link":"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/","title":{"rendered":"[Solved] Why do Parameterized queries allow for moving user data out of string to be interpreted?"},"content":{"rendered":"

[ad_1]
\n<\/p>\n

\n
\n
<\/div>\n
\n
\n

Compiled queries use special syntax that the database understands. They usually add placeholders for parameters such as in:<\/p>\n

select * from applicant where name = ?\n\nselect * from applicant where name = :name\n<\/code><\/pre>\n
The exact syntax depends on the specific technology: JDBC, ODBC, etc.<\/p>\n
Now, once those queries are sent to the database (without the specific parameter values), the database “saves” them. Later on (usually in the same database session), you can run them many times, by just providing the parameter values each time.<\/p>\n
SQL Injection Safety<\/strong><\/p>\n
They are also safe against SQL injection. For example, if in the previous query instead of a simple value such as Mary<\/code> you used the value x'; delete from applicant; --<\/code> the database will work safely. It would run something like:<\/p>\n
select * from applicant where name=\"x; delete from applicant; --\"\n<\/code><\/pre>\n
This query won’t probably find anything and will be safe.<\/p>\n
If instead you didn’t use compiled query, but just decided to concatenate the SQL as a string you would do something like:<\/p>\n
String sql = \"select * from applicant where name=\"\" + param1 + \"\"\";\n<\/code><\/pre>\n
And would end up with the UNSAFE query:<\/p>\n
select * from applicant where name=\"x\"; delete from applicant; --\n<\/code><\/pre>\n
This one would run two queries. The second one will delete all the information from your table. Probably not what you want.<\/p>\n<\/p><\/div>\n
<\/div>\n<\/div>\n
            3<\/span> <\/p><\/div>\n<\/div>\n
[ad_2]<\/p>\n
solved Why do Parameterized queries allow for moving user data out of string to be interpreted? <\/p>\n","protected":false},"excerpt":{"rendered":"
[ad_1] Compiled queries use special syntax that the database understands. They usually add placeholders for parameters such as in: select * from applicant where name = ? select * from applicant where name = :name The exact syntax depends on the specific technology: JDBC, ODBC, etc. Now, once those queries are sent to the database … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[320],"tags":[3523,341,343],"class_list":["post-13098","post","type-post","status-publish","format-standard","hentry","category-solved","tag-code-injection","tag-sql","tag-sql-injection"],"yoast_head":"\n[Solved] Why do Parameterized queries allow for moving user data out of string to be interpreted? - JassWeb<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"[Solved] Why do Parameterized queries allow for moving user data out of string to be interpreted? - JassWeb\" \/>\n<meta property=\"og:description\" content=\"[ad_1] Compiled queries use special syntax that the database understands. They usually add placeholders for parameters such as in: select * from applicant where name = ? select * from applicant where name = :name The exact syntax depends on the specific technology: JDBC, ODBC, etc. Now, once those queries are sent to the database ... Read more\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/\" \/>\n<meta property=\"og:site_name\" content=\"JassWeb\" \/>\n<meta property=\"article:published_time\" content=\"2022-10-02T18:58:01+00:00\" \/>\n<meta name=\"author\" content=\"Kirat\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kirat\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/\"},\"author\":{\"name\":\"Kirat\",\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/person\/65c9c7b7958150c0dc8371fa35dd7c31\"},\"headline\":\"[Solved] Why do Parameterized queries allow for moving user data out of string to be interpreted?\",\"datePublished\":\"2022-10-02T18:58:01+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/\"},\"wordCount\":205,\"publisher\":{\"@id\":\"https:\/\/jassweb.com\/solved\/#organization\"},\"keywords\":[\"code-injection\",\"sql\",\"sql-injection\"],\"articleSection\":[\"Solved\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/\",\"url\":\"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/\",\"name\":\"[Solved] Why do Parameterized queries allow for moving user data out of string to be interpreted? - JassWeb\",\"isPartOf\":{\"@id\":\"https:\/\/jassweb.com\/solved\/#website\"},\"datePublished\":\"2022-10-02T18:58:01+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jassweb.com\/solved\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"[Solved] Why do Parameterized queries allow for moving user data out of string to be interpreted?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jassweb.com\/solved\/#website\",\"url\":\"https:\/\/jassweb.com\/solved\/\",\"name\":\"JassWeb\",\"description\":\"Build High-quality Websites\",\"publisher\":{\"@id\":\"https:\/\/jassweb.com\/solved\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jassweb.com\/solved\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jassweb.com\/solved\/#organization\",\"name\":\"Jass Web\",\"url\":\"https:\/\/jassweb.com\/solved\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jassweb.com\/wp-content\/uploads\/2021\/02\/jass-website-logo-1.png\",\"contentUrl\":\"https:\/\/jassweb.com\/wp-content\/uploads\/2021\/02\/jass-website-logo-1.png\",\"width\":693,\"height\":132,\"caption\":\"Jass Web\"},\"image\":{\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/person\/65c9c7b7958150c0dc8371fa35dd7c31\",\"name\":\"Kirat\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/jassweb.com\/solved\/wp-content\/litespeed\/avatar\/1261af3c9451399fa1336d28b98ea3bb.jpg?ver=1776403586\",\"contentUrl\":\"https:\/\/jassweb.com\/solved\/wp-content\/litespeed\/avatar\/1261af3c9451399fa1336d28b98ea3bb.jpg?ver=1776403586\",\"caption\":\"Kirat\"},\"sameAs\":[\"http:\/\/jassweb.com\"],\"url\":\"https:\/\/jassweb.com\/solved\/author\/jaspritsinghghumangmail-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"[Solved] Why do Parameterized queries allow for moving user data out of string to be interpreted? - JassWeb","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/","og_locale":"en_US","og_type":"article","og_title":"[Solved] Why do Parameterized queries allow for moving user data out of string to be interpreted? - JassWeb","og_description":"[ad_1] Compiled queries use special syntax that the database understands. They usually add placeholders for parameters such as in: select * from applicant where name = ? select * from applicant where name = :name The exact syntax depends on the specific technology: JDBC, ODBC, etc. Now, once those queries are sent to the database ... Read more","og_url":"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/","og_site_name":"JassWeb","article_published_time":"2022-10-02T18:58:01+00:00","author":"Kirat","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Kirat","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/#article","isPartOf":{"@id":"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/"},"author":{"name":"Kirat","@id":"https:\/\/jassweb.com\/solved\/#\/schema\/person\/65c9c7b7958150c0dc8371fa35dd7c31"},"headline":"[Solved] Why do Parameterized queries allow for moving user data out of string to be interpreted?","datePublished":"2022-10-02T18:58:01+00:00","mainEntityOfPage":{"@id":"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/"},"wordCount":205,"publisher":{"@id":"https:\/\/jassweb.com\/solved\/#organization"},"keywords":["code-injection","sql","sql-injection"],"articleSection":["Solved"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/","url":"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/","name":"[Solved] Why do Parameterized queries allow for moving user data out of string to be interpreted? - JassWeb","isPartOf":{"@id":"https:\/\/jassweb.com\/solved\/#website"},"datePublished":"2022-10-02T18:58:01+00:00","breadcrumb":{"@id":"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/jassweb.com\/solved\/solved-why-do-parameterized-queries-allow-for-moving-user-data-out-of-string-to-be-interpreted\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jassweb.com\/solved\/"},{"@type":"ListItem","position":2,"name":"[Solved] Why do Parameterized queries allow for moving user data out of string to be interpreted?"}]},{"@type":"WebSite","@id":"https:\/\/jassweb.com\/solved\/#website","url":"https:\/\/jassweb.com\/solved\/","name":"JassWeb","description":"Build High-quality Websites","publisher":{"@id":"https:\/\/jassweb.com\/solved\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jassweb.com\/solved\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/jassweb.com\/solved\/#organization","name":"Jass Web","url":"https:\/\/jassweb.com\/solved\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jassweb.com\/solved\/#\/schema\/logo\/image\/","url":"https:\/\/jassweb.com\/wp-content\/uploads\/2021\/02\/jass-website-logo-1.png","contentUrl":"https:\/\/jassweb.com\/wp-content\/uploads\/2021\/02\/jass-website-logo-1.png","width":693,"height":132,"caption":"Jass Web"},"image":{"@id":"https:\/\/jassweb.com\/solved\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/jassweb.com\/solved\/#\/schema\/person\/65c9c7b7958150c0dc8371fa35dd7c31","name":"Kirat","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jassweb.com\/solved\/#\/schema\/person\/image\/","url":"https:\/\/jassweb.com\/solved\/wp-content\/litespeed\/avatar\/1261af3c9451399fa1336d28b98ea3bb.jpg?ver=1776403586","contentUrl":"https:\/\/jassweb.com\/solved\/wp-content\/litespeed\/avatar\/1261af3c9451399fa1336d28b98ea3bb.jpg?ver=1776403586","caption":"Kirat"},"sameAs":["http:\/\/jassweb.com"],"url":"https:\/\/jassweb.com\/solved\/author\/jaspritsinghghumangmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/posts\/13098","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/comments?post=13098"}],"version-history":[{"count":0,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/posts\/13098\/revisions"}],"wp:attachment":[{"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/media?parent=13098"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/categories?post=13098"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/tags?post=13098"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}