Re: AW: Identity column

[Booth Martin <booth@xxxxxxxxxxxx>]

Thank you for the heads up, and for the explanation in terms I can follow.

To answer your question, if I am reading you right, the danger is in 
dynamic SQL.  That is way above where I am at.  That'd be at least 
advanced intermediate?  Its not clear if I will ever reach Intermediate 
although I have been pleasantly surprised at how SQL has so many 
choices, but the choices make sense, and provide simplicity of 
programming and complexity of results.

On 12/1/2015 10:41 AM, Charles Wilt wrote:
> Booth,
>
> Since you're learning...I have to ask, are you taking care to avoid SQL
> Injection?
>
> You should always either use static SQL or if you must use dynamic, then
> use parameter markers.
>
> Good (static)
> exec sql
>    update mytbl
>    set myfld = 'XYZ'
>    where mykey = :hostvar;
>
> Also good (dynamic with parameter marker)
> wSql = "update mytbl
>          set myfld = 'XYZ'
>          where mykey = ?";
> exec sql
>    prepare mystm from wSQL;
> exec SQL
>    execute mystm using :hostvar;
>
> Bad (dynamic sql w/o parameter marker)
> wSql = "update mytbl
>          set myfld = 'XYZ'
>          where mykey = " + hostvar;
>
> Charles