RE: SQL Problem

[David FOXWELL <David.FOXWELL@xxxxxxxxx>]

> -----Message d'origine-----
> [mailto:rpg400-l-bounces@xxxxxxxxxxxx] De la part de Charles Wilt
> Note however, if you have something like so
>
> wSQL = 'select * from XYZ where fld2 = ' + QUOTE + 
> inFld2Value + QUOTE;
>
> you are opening yourself up to SQL injection attacks.  
> Instead, you should use parametrized statements:
>
> wSQL = 'select * from XYZ where fld2 = ?';
>
> /exec SQL prepare C1 from :wSQL;
>
> /exec SQL open C1 using :inFld2Value;

Charles,
Can you illustrate what you mean by an injection attack?

Thanks.