Re: SQL Problem

If you fill in your name on a form as say:

Robert)'; drop table customer; --

and it executes on the server, that's a SQL injection. When stringing together user supplied values and building a statement from scratch, and then preparing and executing it, you are more susceptible to such an attack.

David FOXWELL wrote:

-----Message d'origine-----
[mailto:rpg400-l-bounces@xxxxxxxxxxxx] De la part de Charles Wilt
Note however, if you have something like so

wSQL = 'select * from XYZ where fld2 = ' + QUOTE + inFld2Value + QUOTE;

you are opening yourself up to SQL injection attacks. Instead, you should use parametrized statements:

wSQL = 'select * from XYZ where fld2 = ?';

/exec SQL prepare C1 from :wSQL;

/exec SQL open C1 using :inFld2Value;

Charles,
Can you illustrate what you mean by an injection attack?

Thanks.