Re: JDBCR4 question -- Checking the syntax of a query without crashing the JVM

On 2/26/14 8:42 AM, Charles Wilt wrote:

James,

SQL injection only applies to applications that make use of SQL; in what is
supposed to be a limited way by end users.

STRSQL, SQuirreL, Run SQL Scripts are not such apps.

Neither is this project, except that it generates queries to force SQL to mimic the behavior of RLA (quite a trick when you don't even know how many keyfields a file has in its access path). If it were enforcing limits on access, it wouldn't require a separate JDBC sign-on every time it establishes a connection, and it wouldn't be designed specifically to work on whatever file it's directed at, regardless of the file's shape or DB engine.

But that doesn't negate the need to force safe, valid WHERE clauses, whether generated or user-entered. And unfortunately, on my way home last night, I realized that my first attempt at a front-end was far too limited to be useful, because it had no way of making multiple comparisons on a given field, much less generating complex logic like, say,
> (FOO = 'bar' OR FOO = 'baz') AND FROBOZZ > 5 AND FROBOZZ < 20

--
JHHL