Noticing that I forgot to implement XSS scripting protection on my web application development final before turning it in. But I also don’t see anything about it on the rubric either.

Guess I’ll never be graded on my parameterized SQL

I think that writing all your SQL PHP code like this:

$final_stmt = $conn->prepare("INSERT INTO finalDragonGuestbook (name, guestbookComment) VALUES (?, ?)");
$final_stmt->bind_param("ss", $name, $comment);
$final_stmt->execute();
$final_stmt->close();

Makes it more resilient against injections, but idk that doesn’t really make sense. Sure is a lot more difficult than string interpolation.

@soulfire oh that is probably why php apps still have sql injection attacks in 2025