Your opinion Charles and what seems a very strong opinion. J
Yes, I've heard of SQL Injection attacks and no my suggestion does not
leave you open to this sort of attack. I've also heard of LDAP
injection attacks.
What I suggested does not impact PCI compliance or any other security
parameters. Nor does it impact FDA compliance. All the MODULE does is
build an SQL string. When bound with other modules to make an
executable object there are no compliance issues.
If you create ILE programs that allow updating modules or service
programs then you have a behavior that needs changing. My opinion is,
and it is only my opinion, you should NEVER create a program with Allow
update. You are just asking for trouble in the ILE world.
If you have ulcer causing issues with pgmToBuildSQL make it a copy
module rather than a bound module.
Regards,
Gary
-----Original Message-----
From: rpg400-l-bounces@xxxxxxxxxxxx
[mailto:rpg400-l-bounces@xxxxxxxxxxxx] On Behalf Of Charles Wilt
Sent: Friday, July 29, 2011 10:35 AM
To: RPG programming on the IBM i / System i
Subject: Re: Reduce large amount of logicals in SUBFL pgm,take in
another direction
Very, very BAD IDEA!
Horrible in fact.
I hope you're not subject to PCI compliance rules, as the code you
posted pretty much guarantees an automatic failure.
Try googleing for "SQL injection"...
Charles
On Fri, Jul 29, 2011 at 1:16 PM, Monnier, Gary <Gary.Monnier@xxxxxxxxx
<mailto:Gary.Monnier@xxxxxxxxx> > wrote:
Sharon,
The process that builds your SQL statement can have parameters passed
to it. One of these parameters can be a list of selections.
Something like this.
pgmToBuildSQL PR
nbrFieldsForWhereClause
arrayOfFieldsForWhereClause
arrayOfValuesForWhereClause
SQLStringBegin = 'Select * From yourfile ';
X = 1;
startPos = 1;
doW (X < = nbrFieldsForWhereClause);
whereValue = arrayOfFieldsForWhereClause(X) +
arrayOfValuesForWhereClause(X); //ValueFor can be = value, like
value, etc
valueLen = %len(%trimr(whereValue));
%subst(whereClause:startPos:valueLen) = whereValue;
startpos = startPos + valueLen + 1;
X = X + 1;
enddo;
Return;
--
This is the RPG programming on the IBM i / System i (RPG400-L) mailing
list To post a message email: RPG400-L@xxxxxxxxxxxx
<mailto:RPG400-L@xxxxxxxxxxxx> To subscribe, unsubscribe, or change
list options,
visit:
http://lists.midrange.com/mailman/listinfo/rpg400-l
<
http://lists.midrange.com/mailman/listinfo/rpg400-l>
or email: RPG400-L-request@xxxxxxxxxxxx
<mailto:RPG400-L-request@xxxxxxxxxxxx>
Before posting, please take a moment to review the archives at
http://archive.midrange.com/rpg400-l
<
http://archive.midrange.com/rpg400-l> .
midrange.com
