Re: Reduce large amount of logicals in SUBFL pgm, take in another direction

On Mon, Aug 1, 2011 at 2:39 PM, Michael Ryan <michaelrtr@xxxxxxxxx> wrote:

It's a user input thing, not a program creation type thing.

Pretty much. It's how the user input is used. The same input could
be safe or not depending on how your program makes use of it.

If the SQL
statement isn't created by user input, then you wouldn't have an SQL
injection issue. Right?

Correct, but it might be better to say if the "If the SQL statement
doesn't get built using any form of concatenation of direct user
input."

In other words, the whole statement doesn't have to be input by the
user...if all you've got is
wSqlStmt = wSqlStmt + someStringEnteredByUser;

you have a vulnerability.

Charles