From: ldo@nz.invalid   
      
   On Tue, 8 Jul 2025 18:40:31 -0400, Arne Vajhøj wrote:   
      
   > Dynamically creating SQL string where the dynamic part is for data is a   
   > security disaster waiting to happen (and possible poor performance as   
   > well).   
      
   That’s a pretty naïve statement to make.   
      
   Quoting literal data in standard SQL is quite simple: turn the data into a   
   string literal with single quotation marks, and any embedded single   
   quotation marks are written twice. That’s it. Every other character can be   
   represented as itself, literally.   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)