Is there any techniques to avoid SQL injection when I develop on iPhone using Objective C?

Question

I have a text area for user to input something, and I will pass the text as a parameter to server, is there any way / api to ensure the user's text must be valid, even they are not valid, should be treat it as a normal string? (Escaping API?) Thank you.

Answer 1

You should be handling this on the server end, rather than assuming that all your input will come from your trusted iPhone app.

There are many packages that wrap database access and automatically handle string quoting and the like. ORM is a mature technology with many other benefits. Use it. Don't hand write INSERTs and UPDATEs and you will be fine.