in reply to Preventing SQL injection attacks: are -T and placeholders not enough?

There are certain cases where using placeholders is difficult (e.g. the column name or table name is being set dynamically), but I can't think of any case where you would use placeholders and they wouldn't properly quote your arguments. This sounds like some kind of posturing or misunderstanding on their part. I doubt there is anything to it.
  • Comment on Re: Preventing SQL injection attacks: are -T and placeholders not enough?