Re: Reduce large amount of logicals in SUBFL pgm, take in another direction

[Charles Wilt <charles.wilt@xxxxxxxxx>]

Thank you Rory.

But I think we have far more agreements than disagreements...and those
are usually just a matter of degree!

Charles

On Mon, Aug 1, 2011 at 3:16 PM, Rory Hewitt <rory.hewitt@xxxxxxxxx> wrote:
> Gary,
>
> I have been known to disagree with Charles on assorted matters, but on this
> one, he's absolutely correct.
>
> If you have code somewhere in your application which directly concatenates
> strings to form an SQL statement and one of those strings comes directly
> from the user, you may be at risk of SQL injection (depending on the
> specific strings). It doesn't matter whether this is in a top-level program
> or some code in a module that's bound into a service program way deep in
> your application.
>
> As has been pointed out, you can mitigate/avoid this, by either using
> parameters or by manually 'cleaning' the user-provided string yourself.
>
> Rory