Re: Reduce large amount of logicals in SUBFL pgm, take in another direction

On 8/1/2011 9:19 AM, Joe Pluta wrote:

"Nothing idiotic about it. As people have been trying to explain (but it's difficult!), the issue has to do with how the statement is parsed. Most specifically, it has to do with the semicolon, which in an interpreted SQL denotes the end of one statement and the beginning of another. So look at this:

update mytable set description = "?" where key = "value"

In an interpreted statement, the user can replace the ? with a carefully crafted set of character that looks like this:

"; drop table myTable;

The final SQL statement to be executed will look like this:

update mytable set description = ""; drop table myTable;" where key = "value"

The first double-quote in the substituted value closes the quoted string, and thus the semicolon is treated as a statement break. This will execute the statement { update mytable set description = "" } (which will incidentally update every row because there's no where clause), then execute the statement { drop table myTable } which will delete myTable, and then attempt to execute { " where key = "value" } which will fail, but the damage has already been done."

********************************
The buzzing word "Injection" is in the air and the explanation above sounds very impressive, but it doesn't work this way!!!

Having a look to the statement above, having in mind, that we are talking about embedded SQL in RPG::
update mytable set description = ""; drop table myTable;" where key = "value"

sending this to the database with prepare or execute immediate will die at the first pair of doublequotes, because the database engine doesn't know any field named "" (in words: BLANK) and this name would be illegal anyway. changing the two doublequotes to four simple quotes, so that the first part of the statement will become legal, the statement will die at the ; (in Words: semicolon), complaining
Token ; was not valid. Valid tokens: <END-OF-STATEMENT>.

Conclusion of this all:
- injection is no reason to avoid dynamic sql and to use static sql or even stuck with rla
- injection is no reason to write unneeded and useless stored procedures
- db2/400 is not as bad, as some friends of it suppose
- check sqlcode or sqlstate after each SQL statement to catch unpredicted error situations

Dieter Bender

PS: yes, I know, parameter markers are more stable than mounting literals, but in this case, its not injection!