Re: SQL Injection???

[Mike <koldark@xxxxxxxxx>]

I think the i5/OS is more resistant to this type of thing, BUT you still
have to take great care in what you do.

On Fri, May 30, 2008 at 1:48 PM, Bradley V. Stone <bvstone@xxxxxxxxxxxx>
wrote:

> > But....
> >
> > If you get back ID = "7;delete from customer" in your webpage and you
> > blindly concatenate that you'll get "select fld1, fld2 from file where
> > id = 7;delete from customer" and you'll send that off to the sql engine
> > to be interpreted and you'll get... a mess.
> >
> > -Walden
>
>
> Token ; was not valid. Valid tokens: <END-OF-STATEMENT>.
>
> That's what I got.
>
> Brad
> --
> This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
> To post a message email: WEB400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/web400.