Re: Reduce large amount of logicals in SUBFL pgm, take in another direction

Rory,

You're correct, in a 5250 RPG app it's unlikely for SQL injection to occur...

But as you say, it *could* happen and in my mind that makes the app
unsafe period. Is a Ford pinto safe or unsafe? After all, not all of
them exploded when rear ended...

Even more likely if you end up calling the routine from someplace
besides and interactive session, and that is the idea right?

As you point out, using parameters is simply good practice....better
to be in the habit of it regardless of what language or environment
you are working in. And again, as you say parameters aren't hard to
use; personally I think they are easier as you don't have to worry
about the quotes in the statement.

Charles

On Mon, Aug 1, 2011 at 4:17 PM, Rory Hewitt <rory.hewitt@xxxxxxxxx> wrote:

Charles,

Whilst I obviously understand the problem of SQL injection, it is
*much*less of a problem with RPG than with e.g. C-like languages, for
many of the
same reasons that buffer overflows don't really hit RPG - because we don't
use open-ended strings with variable lengths to anything like the same level
that those other languages do.

For instance, using your example, the user has to have defined
userEnteredValue as a string of a certain length. If it's e.g. 10
characters, it's *very* hard to do much damage. Obviously if it's a long
character string, it gets more likely that bad things can happen, but that's
rare, especially ina  select statement.

Another reason, of course, is that if the program is an RPG interactive
program, you can be pretty sure that it's not being accessed across the web.
With a C program (not an IBM i interactive C program, obviously, but who
writes those anyway?), there is always the risk that it can be called from
lots of different places other than those where it was designed to be called
from.

The reason I use parameters is simply because it's "good practice". Plus, I
won't get hassled on this forum :)

Look, I think Gary should use parameters instead of direct concatenation,
but that doesn't mean that his application is currently *actually* unsafe -
just that it *could* be, in ways that parameters would mitigate.

Rory