Tag
input-validation
- Jul 16, 2026 The Places Parameter Binding Cannot Reach Identifiers, sort direction, operators, and collation are resolved before execution, so binding cannot protect them; the designs that survive are structural. security
- Jun 14, 2026 SQL Injection as a Failure of the Tokenization Boundary Why a database cannot distinguish a value from a statement once they are concatenated into one string, and how separate parameter transport restores the boundary. security
- Dec 6, 2023 Deserialization as Re-entry Across the Trust Boundary Why parsing untrusted bytes into objects is the most exposed operation a runtime performs, how format-directed object construction grants authority, and which design choices contain the damage. language runtimes