MIDRANGE dot COM Mailing List Archive



Home » WEB400 » May 2008

Re: SQL Injection???



fixed

Mike,

I have a few programs that dynamically build SQL statements in RPG. Is
this what you mean or do you mean using html & javascript variables?

Shane Cessna
Senior Programmer
North American Lighting, Inc.
217.465.6600 x7776



Mike <koldark@xxxxxxxxx>
Sent by: web400-bounces@xxxxxxxxxxxx
05/30/2008 09:06 AM
Please respond to
Web Enabling the AS400 / iSeries <web400@xxxxxxxxxxxx>


To
"Web Enabling the AS400 / iSeries" <web400@xxxxxxxxxxxx>
cc

Subject
Re: [WEB400] SQL Injection???






From my basic understanding of how this works, the big thing is not to
dynamically build the SQL statements. Do not do:

"Select * from MyTable where MyKey = " + passedkeyfield;

Instead, make use of the host variables.

On Fri, May 30, 2008 at 8:44 AM, <Shane_Cessna@xxxxxxx> wrote:

All:

Has anyone using CGIDEV2 implemented a solution to prevent SQL Injection
attacks in your applications? If so, what did you use and how did you
do
it?

This is one of my security goals for this year in case you're curious.

Shane Cessna
Senior Programmer
North American Lighting, Inc.
217.465.6600 x7776
--
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/web400.









Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2014 by MIDRANGE dot COM and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available here. If you have questions about this, please contact