Files

T

Antigravity Agent e9cbf23ab5 docs(10_Wiki): Dev 폴더 누락분 반영 — Topic_Programming으로 통합

이전 재구성 작업에서 Dev/ 폴더가 누락되었던 것을 반영.

- Dev/Topic_Programming(중첩 폴더, 78개)은 Dev 자체 최상위 폴더들
  (Architecture/Conventions/Engineering_Intelligence 등)과 완전 중복이라 제거.
- Dev 최상위 엔지니어링 지식 폴더(Architecture/Conventions/Engineering_Intelligence/
  Failure_Library/Generalized_Principles/Language/Pattern_Catalog/Platform_Guides/
  Subsystems, 77개)는 이미 Topic_Programming/Topic_Programming에 더 최신 버전이
  존재해 중복 제거(고유 콘텐츠 1개는 예외 처리하여 이동 보존).
- Dev의 W3Schools 언어 튜토리얼 폴더(Topic_C/CPP/CSS/CSharp/HOWTO/HTML/Java/
  JavaScript/PHP/Python/SQL/W3CSS, 1201개)는 전부 Topic_Programming 하위로 이동.
- 에이전트 운영 상태(.astra/docs)는 그대로 유지, 콘텐츠 폴더만 정리.
- Topic_Programming 최종 문서 수: 2784 → 3985.

2026-07-05 00:39:13 +09:00

3.8 KiB

Raw Blame History

id, title, category, status, verification_status, canonical_id, aliases, duplicate_of, source_trust_level, confidence_score, created_at, updated_at, review_reason, merge_history, tags, raw_sources, applied_in, github_commit

title

SQL Parameters

🎯 한 줄 통찰 (One-line insight)

Parameterized queries fix SQL injection by sending user input as placeholder-bound values instead of concatenated text, so the database always treats the input literally, never as executable SQL. [S1]

🧠 핵심 개념 (Core concepts)

Parameterized query — an SQL statement using placeholders instead of directly embedding input values in the query text; placeholders are replaced with actual values at execution time. [S1]
Placeholder syntax varies by vendor — MySQL uses ?, SQL Server uses @, PostgreSQL uses $. [S1]
Literal treatment guarantee — the SQL engine checks each parameter against its column type and treats it literally, not as part of the executable SQL — this is what neutralizes injection. [S1]

🧩 추출된 패턴 (Extracted patterns)

Same fix for SELECT and INSERT — the parameterization pattern applies identically whether reading (SELECT ... WHERE UserId = @userid) or writing (INSERT INTO ... VALUES(@cname, @caddress, @ccity)). [S1]
Bind-then-execute in application code — frameworks like ASP.NET separate building the query text (with placeholders) from binding actual values (cmd.Parameters.AddWithValue(...)), directly countering the string-concatenation root cause from SQL Injection. [S1]

📖 세부 내용 (Details)

SQL Server-style placeholder query: query = "SELECT * FROM Users WHERE UserId = @userid"; db.Execute(query, userid);. [S1]
Parameterized INSERT: query = "INSERT INTO Customers (CustomerName, Address, City) Values(@cname, @caddress, @ccity)"; db.Execute(query, cname, caddress, ccity);. [S1]
ASP.NET binding pattern: cmd = new SqlCommand(query); cmd.Parameters.AddWithValue("@userid", userid); cmd.ExecuteReader();. [S1]

⚖️ 모순 및 업데이트 (Contradictions & updates)

소스에서 모순되는 정보는 발견되지 않음.

🛠️ 적용 사례 (Applied in summary)

현재 발견된 실제 적용 사례가 없습니다 — 앞서 SQL Injection 챕터에서 보여준 문자열 연결(concatenation) 취약점을 직접 해소하는 대응책이다. [S1]

💻 코드 패턴 (Code patterns)

Parameterized SELECT (ASP.NET, SQL Server style):

userid = getRequestString("UserId");
query = "SELECT * FROM Customers WHERE CustomerId = @userid";
cmd = new SqlCommand(query);
cmd.Parameters.AddWithValue("@userid", userid);
cmd.ExecuteReader();

✅ 검증 상태 및 신뢰도

상태: draft
검증 단계: conceptual
출처 신뢰도: B (W3Schools — widely used educational reference, not a primary standards body)
신뢰 점수: 0.87
중복 검사 결과: 신규 생성 (New discovery)

🔗 지식 그래프 (Knowledge Graph)

상위/루트: SQL Tutorial
관련 개념: SQL Injection, SQL Prepared Statements
참조 맥락: SQL Injection의 직접적인 대응책 — Prepared Statements와 함께 사용자 입력을 다루는 표준 방어법.

📚 출처 (Sources)

[S1] W3Schools — SQL Parameters — https://www.w3schools.com/sql/sql_parameterized_queries.asp

📝 변경 이력 (Change history)

2026-07-04: Initial draft synthesized from the W3Schools "SQL Parameters" page (Astra wiki-curation, P-Reinforce v3.1 format).

3.8 KiB Raw Blame History