RE: rules to escape special chars and avoid SQL Injection

-----Original Message-----
From: java400-l-bounces@xxxxxxxxxxxx
[mailto:java400-l-bounces@xxxxxxxxxxxx] On Behalf Of John Arevalo
Sent: Wednesday, March 23, 2011 2:46 PM
To: java400-l@xxxxxxxxxxxx
Subject: rules to escape special chars and avoid SQL Injection

Hi list,

This is my first post, i didn't find appropiate list for PHP
development, i apologize for it.

i need to escape properly any value read from input user. i found it's
posible escape single quote with two single-quotes,

do you know all rules for avoid SQL Injection?

Thanks for your replies.

--
John Arévalo

I'd suggest doing a search on "sql injection" to see a lot of examples. What I tend to do (in Perl on Linux at least), is to use a prepared statement. From what I can see, Java supports this method. It is a bit like compiling a program and asking the user for input data instead of asking the user for a statement and then dynamically executing that statement.

Exactly how this is done seems to be both database and programming language dependent. I found an interesting post at the end of this page: http://www.php.net/manual/en/security.database.php
<quote>
I would say one of the best ways to guard against SQL injection is to use the excellent PEAR DB package. If you prepare() and execute() your queries, PEAR will automagically addslashes and handle the query depending on your RDBMS. And of course, for repeatable queries prepare and execute will give you a bit of a readability and speed increase.
</quote>

This is the equivalent in PHP to what I do in Perl.


BTW - I doubt that anybody know __all__ the rules because some clever person will find a way around them.

--
John McKown
Systems Engineer IV
IT

Administrative Services Group

HealthMarkets®

9151 Boulevard 26 . N. Richland Hills . TX 76010
(817) 255-3225 phone .
john.mckown@xxxxxxxxxxxxxxxxx . www.HealthMarkets.com

Confidentiality Notice: This e-mail message may contain confidential or proprietary information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. HealthMarkets® is the brand name for products underwritten and issued by the insurance subsidiaries of HealthMarkets, Inc. -The Chesapeake Life Insurance Company®, Mid-West National Life Insurance Company of TennesseeSM and The MEGA Life and Health Insurance Company.SM