× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.



-----Original Message-----
From: java400-l-bounces@xxxxxxxxxxxx
[mailto:java400-l-bounces@xxxxxxxxxxxx] On Behalf Of John Arevalo
Sent: Wednesday, March 23, 2011 2:46 PM
To: java400-l@xxxxxxxxxxxx
Subject: rules to escape special chars and avoid SQL Injection

Hi list,

This is my first post, i didn't find appropiate list for PHP
development, i apologize for it.

i need to escape properly any value read from input user. i found it's
posible escape single quote with two single-quotes,

do you know all rules for avoid SQL Injection?

Thanks for your replies.

--
John Arévalo

I'd suggest doing a search on "sql injection" to see a lot of examples. What I tend to do (in Perl on Linux at least), is to use a prepared statement. From what I can see, Java supports this method. It is a bit like compiling a program and asking the user for input data instead of asking the user for a statement and then dynamically executing that statement.

Exactly how this is done seems to be both database and programming language dependent. I found an interesting post at the end of this page: http://www.php.net/manual/en/security.database.php
<quote>
I would say one of the best ways to guard against SQL injection is to use the excellent PEAR DB package. If you prepare() and execute() your queries, PEAR will automagically addslashes and handle the query depending on your RDBMS. And of course, for repeatable queries prepare and execute will give you a bit of a readability and speed increase.
</quote>

This is the equivalent in PHP to what I do in Perl.


BTW - I doubt that anybody know __all__ the rules because some clever person will find a way around them.

--
John McKown
Systems Engineer IV
IT

Administrative Services Group

HealthMarkets®

9151 Boulevard 26 . N. Richland Hills . TX 76010
(817) 255-3225 phone .
john.mckown@xxxxxxxxxxxxxxxxx . www.HealthMarkets.com

Confidentiality Notice: This e-mail message may contain confidential or proprietary information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. HealthMarkets® is the brand name for products underwritten and issued by the insurance subsidiaries of HealthMarkets, Inc. -The Chesapeake Life Insurance Company®, Mid-West National Life Insurance Company of TennesseeSM and The MEGA Life and Health Insurance Company.SM



As an Amazon Associate we earn from qualifying purchases.

This thread ...

Replies:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.