Hacker News Reader

if they escape variables: danger!

Escaping is not sufficient to prevent SQL Injection Attacks. You must used Parameterized Queries.

> Escaping is not sufficient to prevent SQL Injection Attacks.

Do you have an example or idea of how a SQL injection could occur despite using http://php.net/manual/en/function.mysql-real-escape-string.p... ?

I'm pretty sure the audience on HN understands sql injection without having to refer to a cartoon.

Yes, but Little Bobby Tables is an inside joke for the HN audience. I love that comic!

It's a good one, no doubt. And it's true that the resources of the linked site go beyond the world of drawn panes.