Antigravity Agent
9a135bd19d
최상위 10_Wiki/Topic_*였던 4개 카테고리 폴더를 10_Wiki/Topics/Topic_* 로 재배치. 콘텐츠 변경 없음(순수 폴더 이동) — Topics/ 하위 나머지 폴더는 이미 지난 커밋에서 전부 정리된 상태(잔존 항목은 에이전트 운영 상태 및 사용자가 보존을 요청한 업데이트0615/무제 3.canvas 뿐).
3.8 KiB
3.8 KiB
id, title, category, status, verification_status, canonical_id, aliases, duplicate_of, source_trust_level, confidence_score, created_at, updated_at, review_reason, merge_history, tags, raw_sources, applied_in, github_commit
| id | title | category | status | verification_status | canonical_id | aliases | duplicate_of | source_trust_level | confidence_score | created_at | updated_at | review_reason | merge_history | tags | raw_sources | applied_in | github_commit | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| sql-parameters | SQL Parameters | Database | draft | conceptual |
|
B | 0.87 | 2026-07-04 | 2026-07-04 |
|
|
SQL Parameters
🎯 한 줄 통찰 (One-line insight)
Parameterized queries fix SQL injection by sending user input as placeholder-bound values instead of concatenated text, so the database always treats the input literally, never as executable SQL. [S1]
🧠 핵심 개념 (Core concepts)
- Parameterized query — an SQL statement using placeholders instead of directly embedding input values in the query text; placeholders are replaced with actual values at execution time. [S1]
- Placeholder syntax varies by vendor — MySQL uses
?, SQL Server uses@, PostgreSQL uses$. [S1] - Literal treatment guarantee — the SQL engine checks each parameter against its column type and treats it literally, not as part of the executable SQL — this is what neutralizes injection. [S1]
🧩 추출된 패턴 (Extracted patterns)
- Same fix for SELECT and INSERT — the parameterization pattern applies identically whether reading (
SELECT ... WHERE UserId = @userid) or writing (INSERT INTO ... VALUES(@cname, @caddress, @ccity)). [S1] - Bind-then-execute in application code — frameworks like ASP.NET separate building the query text (with placeholders) from binding actual values (
cmd.Parameters.AddWithValue(...)), directly countering the string-concatenation root cause from SQL Injection. [S1]
📖 세부 내용 (Details)
- SQL Server-style placeholder query:
query = "SELECT * FROM Users WHERE UserId = @userid"; db.Execute(query, userid);. [S1] - Parameterized INSERT:
query = "INSERT INTO Customers (CustomerName, Address, City) Values(@cname, @caddress, @ccity)"; db.Execute(query, cname, caddress, ccity);. [S1] - ASP.NET binding pattern:
cmd = new SqlCommand(query); cmd.Parameters.AddWithValue("@userid", userid); cmd.ExecuteReader();. [S1]
⚖️ 모순 및 업데이트 (Contradictions & updates)
소스에서 모순되는 정보는 발견되지 않음.
🛠️ 적용 사례 (Applied in summary)
현재 발견된 실제 적용 사례가 없습니다 — 앞서 SQL Injection 챕터에서 보여준 문자열 연결(concatenation) 취약점을 직접 해소하는 대응책이다. [S1]
💻 코드 패턴 (Code patterns)
Parameterized SELECT (ASP.NET, SQL Server style):
userid = getRequestString("UserId");
query = "SELECT * FROM Customers WHERE CustomerId = @userid";
cmd = new SqlCommand(query);
cmd.Parameters.AddWithValue("@userid", userid);
cmd.ExecuteReader();
✅ 검증 상태 및 신뢰도
- 상태: draft
- 검증 단계: conceptual
- 출처 신뢰도: B (W3Schools — widely used educational reference, not a primary standards body)
- 신뢰 점수: 0.87
- 중복 검사 결과: 신규 생성 (New discovery)
🔗 지식 그래프 (Knowledge Graph)
- 상위/루트: SQL Tutorial
- 관련 개념: SQL Injection, SQL Prepared Statements
- 참조 맥락: SQL Injection의 직접적인 대응책 — Prepared Statements와 함께 사용자 입력을 다루는 표준 방어법.
📚 출처 (Sources)
- [S1] W3Schools — SQL Parameters — https://www.w3schools.com/sql/sql_parameterized_queries.asp
📝 변경 이력 (Change history)
- 2026-07-04: Initial draft synthesized from the W3Schools "SQL Parameters" page (Astra wiki-curation, P-Reinforce v3.1 format).