Re: sql injection related to iSeries

["Shalom Carmel" <shalom@xxxxxxxxxx>]

DB2/400 is as susceptible to sql injection as the database next door.
See an example on my web site in arcticle "SQL injection in terminal
emulations "

http://www.venera.com/downloads.htm

I also recall an article on itjungle.com - google "sql injection
site:itjungle.com" to find it.

Regards,
Shalom Carmel
-----------------------
www.venera.com


> date: Sun, 18 Feb 2007 00:40:57 -0500
> from: "Jim Franz" <franz400@xxxxxxxxxxxx>
> subject: sql injection related to iSeries
>
> After reviewing archives, I see warnings about sql injection affecting all sql
> processing databases, but all the examples I've found so far on web cover
> ms sql specific problems. Assuming the iSeries does not recognize the  --
> problem, and if I either strip single quotes out of user input, or add the 
> proper
> extra single quote (BJ'S  =  BJ''S),  what would be a good
> practice to code wherever sql is processed?
> As an example, if I have a screen where user can search by name, and
> user enters JOHN, my sqlrpgle builds a string like
> select * from xyz where wwname like '%JOHN%'
> What syntax could someone enter to mess with the system?
> Jim Franz