This question already has an answer here:
This was a while ago, but I still have a few "what-ifs?" in my head. Last year, I was interviewing at some startup based in San Francisco (they actually just got bought). Most parts of the interview went fairly well.
One of the questions was about preventing MySQL injections and I had said that I wrote a wrapper for the MySQLi class on a project to work with MySQL. I said that I passed everything as a parameter to the mysqli object and everything is handled by that class. Anyway, they said that was a security risk because MySQLi did not prevent MySQL injections. I then said that I was pretty sure it did but they continually argued it did not. I am certain that MySQL injections can be prevented by parameterized queries.
What would be the best way to handle this situation? Should I just admit that I was wrong?