Re: SQL Injection???

["Bradley V. Stone" <bvstone@xxxxxxxxxxxx>]

I use dynamic SQL in most of my CGIDEV2 and eRPG SDK (well, lets just say
RPG/CGI) appications.  I've not seen a performance hit, and when it requires
the building of some rather large and complicated statements makes it very
easy.

I guess I don't follow the "do not do this" unless you're talking about
using SELECT * instead of SELECT [fieldlist]

Bradley V. Stone
BVSTools - www.bvstools.com
eRPG SDK - www.erpgsdk.com

> -----Original Message-----
> From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx]On
> Behalf Of Mike
> Sent: Friday, May 30, 2008 9:02 AM
> To: Web Enabling the AS400 / iSeries
> Subject: Re: [WEB400] SQL Injection???
>
>
> > From my basic understanding of how this works, the big thing is not to
> dynamically build the SQL statements. Do not do:
>
> "Select * from MyTable where MyKey = " + passedkeyfield;
>
> Instead, make use of the host variables.
>
> On Fri, May 30, 2008 at 8:44 AM, <Shane_Cessna@xxxxxxx> wrote:
>
> > All:
> >
> > Has anyone using CGIDEV2 implemented a solution to prevent SQL Injection
> > attacks in your applications?  If so, what did you use and how
> did you do
> > it?
> >
> > This is one of my security goals for this year in case you're curious.
> >
> > Shane Cessna
> > Senior Programmer
> > North American Lighting, Inc.
> > 217.465.6600 x7776
> > --
> > This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
> > To post a message email: WEB400@xxxxxxxxxxxx
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/mailman/listinfo/web400
> > or email: WEB400-request@xxxxxxxxxxxx
> > Before posting, please take a moment to review the archives
> > at http://archive.midrange.com/web400.
>
>
> --
> Mike Wills
>
> Check out my music show at http://thenextgenerationofradio.com
> --
> This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
> To post a message email: WEB400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/web400.