Re: AW: Identity column

Thank you for the heads up, and for the explanation in terms I can follow.

To answer your question, if I am reading you right, the danger is in dynamic SQL. That is way above where I am at. That'd be at least advanced intermediate? Its not clear if I will ever reach Intermediate although I have been pleasantly surprised at how SQL has so many choices, but the choices make sense, and provide simplicity of programming and complexity of results.

On 12/1/2015 10:41 AM, Charles Wilt wrote:

Booth,

Since you're learning...I have to ask, are you taking care to avoid SQL
Injection?

You should always either use static SQL or if you must use dynamic, then
use parameter markers.

Good (static)
exec sql
update mytbl
set myfld = 'XYZ'
where mykey = :hostvar;

Also good (dynamic with parameter marker)
wSql = "update mytbl
set myfld = 'XYZ'
where mykey = ?";
exec sql
prepare mystm from wSQL;
exec SQL
execute mystm using :hostvar;

Bad (dynamic sql w/o parameter marker)
wSql = "update mytbl
set myfld = 'XYZ'
where mykey = " + hostvar;

Charles