Re: SQL Injection???

["Walden H. Leverich" <WaldenL@xxxxxxxxxxxxxxx>]

> but in RPG building dynamic SQL I don't see how this would 
> be a problem (other than possibly SQL run time error with the 
> string being used).

> I think this deals mainly with interpreted scripts? I am curious.

It is a problem with interpreted "scripts". The problem is, dynamic SQL
is "interpreted" by the SQL engine at runtime. Thus, if you start with
(in your RPG):

SQL = "select fld1, fld2 from file where id = "

And then get an id# from a web page, say ID = 7 and you do:

SQL = SQL + ID

You'll get SQL = "select fld1, fld2 from file where id = 7" and you'll
pass that to the SQL engine to be interpreted, and all will be right in
the world.

But....

If you get back ID = "7;delete from customer" in your webpage and you
blindly concatenate that you'll get "select fld1, fld2 from file where
id = 7;delete from customer" and you'll send that off to the sql engine
to be interpreted and you'll get... a mess.

-Walden