From 61419caf8b6d473959628dfb9b40476010a74fa1 Mon Sep 17 00:00:00 2001 From: Jay McCarthy Date: Wed, 4 Feb 2009 19:36:31 +0000 Subject: [PATCH] up svn: r13421 --- collects/web-server/scribblings/tutorial/continue.scrbl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/collects/web-server/scribblings/tutorial/continue.scrbl b/collects/web-server/scribblings/tutorial/continue.scrbl index b12e27822b..124bc148f5 100644 --- a/collects/web-server/scribblings/tutorial/continue.scrbl +++ b/collects/web-server/scribblings/tutorial/continue.scrbl @@ -1038,7 +1038,7 @@ We used @scheme[blog-insert-post!] and @scheme[post-insert-comment!] to initiali @centerline{------------} -A user could submit a post with a title like, @scheme{null', 'null') and INSERT INTO accounts (username, password) VALUES ('ur','hacked} and get our simple @scheme[sqlite:insert] to make two INSERTs instead of one. +A user could submit a post with a title like, @scheme["null', 'null') and INSERT INTO accounts (username, password) VALUES ('ur','hacked"] and get our simple @scheme[sqlite:insert] to make two INSERTs instead of one. This is called an SQL injection attack. It can be resolved by using prepared statements that let SQLite do the proper quoting for us. Refer