MIDRANGE dot COM Mailing List Archive



Home » MIDRANGE-L » February 2014

Re: JDBCR4 question -- Checking the syntax of a query without crashing the JVM



fixed

On 2/26/14 8:42 AM, Charles Wilt wrote:
James,

SQL injection only applies to applications that make use of SQL; in what is
supposed to be a limited way by end users.

STRSQL, SQuirreL, Run SQL Scripts are not such apps.

Neither is this project, except that it generates queries to force SQL to mimic the behavior of RLA (quite a trick when you don't even know how many keyfields a file has in its access path). If it were enforcing limits on access, it wouldn't require a separate JDBC sign-on every time it establishes a connection, and it wouldn't be designed specifically to work on whatever file it's directed at, regardless of the file's shape or DB engine.

But that doesn't negate the need to force safe, valid WHERE clauses, whether generated or user-entered. And unfortunately, on my way home last night, I realized that my first attempt at a front-end was far too limited to be useful, because it had no way of making multiple comparisons on a given field, much less generating complex logic like, say,
> (FOO = 'bar' OR FOO = 'baz') AND FROBOZZ > 5 AND FROBOZZ < 20

--
JHHL






Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2014 by MIDRANGE dot COM and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available here. If you have questions about this, please contact