Parameterized queries?

[Rosen, Jason]

I know the queries I want to make that include values from $resolutionContext and would like to make sure they are safe from SQL injection. It sounds like I need to emulate parametrized queries without the help of the RDBMS, but I'm not familiar with how to do that within attribute-resolver.xml. Is there some documentation or example you could point me too?

-Jason
________________________________
From: Cantor, Scott <cantor.2 at osu.edu>
Sent: Tuesday, June 10, 2025 9:30 AM
To: Shib Users <users at shibboleth.net>
Cc: Rosen, Jason <jason.rosen at montana.edu>
Subject: Re: Parameterized queries?

**External Sender**

I should qualify that...

When we know the queries we're making, we use parametrized queries. The RDBMS data connector does not know them and so does not use them.

-- Scott


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250610/c4f03e85/attachment.htm>