×
The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.
but in RPG building dynamic SQL I don't see how this would
be a problem (other than possibly SQL run time error with the
string being used).
I think this deals mainly with interpreted scripts? I am curious.
It is a problem with interpreted "scripts". The problem is, dynamic SQL
is "interpreted" by the SQL engine at runtime. Thus, if you start with
(in your RPG):
SQL = "select fld1, fld2 from file where id = "
And then get an id# from a web page, say ID = 7 and you do:
SQL = SQL + ID
You'll get SQL = "select fld1, fld2 from file where id = 7" and you'll
pass that to the SQL engine to be interpreted, and all will be right in
the world.
But....
If you get back ID = "7;delete from customer" in your webpage and you
blindly concatenate that you'll get "select fld1, fld2 from file where
id = 7;delete from customer" and you'll send that off to the sql engine
to be interpreted and you'll get... a mess.
-Walden
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact
[javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.
midrange.com
