Re: SQL Injection???

[Mike <koldark@xxxxxxxxx>]

Does anyone know of a good book that covers a lot of this information (not
necessarily System i specific)? Something  that goes more in depth so I can
learn more on how to protect against it?

On Fri, May 30, 2008 at 3:06 PM, Haas, Matt (CL Tech Sv) <
matt.haas@xxxxxxxxxxx> wrote:

> I wouldn't say our DB is more resistant (the syntax may be different but
> that doesn't make it invulnerable) but the way that programs are typically
> written and the languages they are typically written in do help. Strongly
> typed variables and fixed length strings are the two things that help save
> you from this.
>
> Most of the examples you'll see will be in run time interpreted languages
> (PHP, classic ASP, etc...) but I've seen it in Java as well (just caught one
> of those in the past few weeks). The important things to understand are the
> patterns for this type of attack and then make sure your programs are not
> vulnerable to them.
>
> Two things that i5/OS does have going for it that other systems don't
> (excluding stuff running in QShell or PASE) is that you can't write
> arbitrary bytes of data to memory and make it run as a program and it has
> very good memory protection.
>
> Matt
>
> -----Original Message-----
> From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx] On
> Behalf Of Mike
> Sent: Friday, May 30, 2008 3:38 PM
> To: Web Enabling the AS400 / iSeries
> Subject: Re: [WEB400] SQL Injection???
>
> I think the i5/OS is more resistant to this type of thing, BUT you still
> have to take great care in what you do.
>
> On Fri, May 30, 2008 at 1:48 PM, Bradley V. Stone <bvstone@xxxxxxxxxxxx>
> wrote:
>
> > > But....
> > >
> > > If you get back ID = "7;delete from customer" in your webpage and you
> > > blindly concatenate that you'll get "select fld1, fld2 from file where
> > > id = 7;delete from customer" and you'll send that off to the sql engine
> > > to be interpreted and you'll get... a mess.
> > >
> > > -Walden
> >
> >
> > Token ; was not valid. Valid tokens: <END-OF-STATEMENT>.
> >
> > That's what I got.
> >
> > Brad
> > --
> > This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
> > To post a message email: WEB400@xxxxxxxxxxxx
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/mailman/listinfo/web400
> > or email: WEB400-request@xxxxxxxxxxxx
> > Before posting, please take a moment to review the archives
> > at http://archive.midrange.com/web400.
>
>
> --
> Mike Wills
>
> Check out my music show at http://thenextgenerationofradio.com
> --
> This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
> To post a message email: WEB400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/web400.
>
>
> --
> This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
> To post a message email: WEB400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/web400.