Exactly, and what does 'checking' even mean in this case. If you're not parameterizing your SQL queries and relying on your home baked string/regex/etc. checks then you've already lost.
I am honestly baffled by developers who think they can sanitize input enough to happily send it to SQL without parameters. Can anyone explain why this would ever be a good idea?
On a side note I also don't understand why anyone would give an app permission to do anything other than read/update data. Honestly if your app can drop tables then isn't it a bit broken from a security standpoint anyway?
I am honestly baffled by developers who think they can sanitize input enough to happily send it to SQL without parameters. Can anyone explain why this would ever be a good idea?
On a side note I also don't understand why anyone would give an app permission to do anything other than read/update data. Honestly if your app can drop tables then isn't it a bit broken from a security standpoint anyway?