Search code examples
sqlsql-injectionsinglestore

MEMSql user defined variable

I have found that MEMSql does not support user defined variables (source).

Is there any workaround of this? Is it going to be in future releases?

I want to do SQL injection protection via user defined variables. Is there any other good way of doing this?

Solution

  • In the future 6.0 release, you can define stored procedures etc and use variables within those - see the documentation. A beta is available now here.

    As for SQL injection protection, most client drivers support running queries with parameters in a way that is not vulnerable to SQL injection. Usually there is a function like query("select * from t where a = ?", 5) which places your params in the query in a safe way.