SQL Injection Docs Should Recommend Parameterized Queries

[tjakway]

MDN URL

https://developer.mozilla.org/en-US/docs/Learn_web_development/Extensions/Server-side/First_steps/Website_security

What specific section or headline is this issue about?

SQL Injection

What information was incorrect, unhelpful, or incomplete?

The MDN docs on SQL Injection recommend escaping user input to prevent SQL injection and do not mention prepared statements with parameterized queries.

What did you expect to see?

The page should be changed to:

1. Advocate prepared statements with parameterized queries.
2. Explicitly discourage (ever) allowing any user-controlled input in query strings.

This is industry-standard and any database API that lacks this should be avoided.

Do you have any supporting links, references, or citations?

OWASP's SQL Injection page (archive link) recommends prepared statements with parameterized queries and says escaping all user input is "STRONGLY DISCOURAGED".

Do you have anything more you want to share?

No response