RE: Interactive SQL ability without UPDATE or DELETE

IBM's WebQuery product is a useful option. GUI/Web interface, can create Users vs Developers. We found that most users don't really need to create queries, and a many changes to queries are to change the month or other period being selected. WebQuery allows those selections when the query is run.

Users also think the interface is 'better' because it's 'GUI.'

Paul E Musselman
PaulMmn@xxxxxxxxxxxxx

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Mike Jones
Sent: Tuesday, April 03, 2018 1:21 PM
To: midrange-l@xxxxxxxxxxxx
Subject: Re: Interactive SQL ability without UPDATE or DELETE

I agree with Rob. Security is much better implemented at the data object
level, not the application layer / tool level.

The problem is implementing security at the data object level tends to be a
lot more work to get that better, and more secure, result.

I doubt there is a way to restrict UPDATE and DELETE statements in STRSQL,
while allowing SELECT statements.

That said, a fairly decent way, at the application layer, to continue
allowing SELECT SQL is to:
1) Lock down STRSQL completely.
2) Provide a GUI SQL tool to the users, like IBM's ACS Run SQL Scripts.
This is a much more productive user interface than STRSQL.
3) Implement programs on exit points QIBM_QZDA_SQL1 and QIBM_QZDA_SQL2 as
needed, to control what types of SQL the users can run from their client
PCs.

Mike