On 2/26/14 8:42 AM, Charles Wilt wrote:
SQL injection only applies to applications that make use of SQL; in what is
supposed to be a limited way by end users.
STRSQL, SQuirreL, Run SQL Scripts are not such apps.
Neither is this project, except that it generates queries to force SQL
to mimic the behavior of RLA (quite a trick when you don't even know how
many keyfields a file has in its access path). If it were enforcing
limits on access, it wouldn't require a separate JDBC sign-on every time
it establishes a connection, and it wouldn't be designed specifically to
work on whatever file it's directed at, regardless of the file's shape
or DB engine.
But that doesn't negate the need to force safe, valid WHERE clauses,
whether generated or user-entered. And unfortunately, on my way home
last night, I realized that my first attempt at a front-end was far too
limited to be useful, because it had no way of making multiple
comparisons on a given field, much less generating complex logic like, say,
> (FOO = 'bar' OR FOO = 'baz') AND FROBOZZ > 5 AND FROBOZZ < 20