Re: SQL Injection???

[Thorbjørn Ravn Andersen <thunderaxiom@xxxxxxxxx>]

Mike skrev  den 30-05-2008 16:02:
> >From my basic understanding of how this works, the big thing is not to
> dynamically build the SQL statements. Do not do:
>
> "Select * from MyTable where MyKey = " + passedkeyfield;
>
> Instead, make use of the host variables.
>   
The idea is to avoid stuff like having MyKey set to "'a'; delete * from 
MyTable; commit" passed as a user string.

You can usually get around this with PreparedStatements, or by putting 
the enclosed string in quotes, and doubling all quotes in the string to 
match.