Re: SQL Injection???

[Shane_Cessna@xxxxxxx]

Mike,

I have a few programs that dynamically build SQL statements in RPG.  Is 
this what you mean or do you mean using html & javascript variables?

Shane Cessna
Senior Programmer
North American Lighting, Inc.
217.465.6600 x7776 



Mike <koldark@xxxxxxxxx> 
Sent by: web400-bounces@xxxxxxxxxxxx
05/30/2008 09:06 AM
Please respond to
Web Enabling the AS400 / iSeries <web400@xxxxxxxxxxxx>


To
"Web Enabling the AS400 / iSeries" <web400@xxxxxxxxxxxx>
cc

Subject
Re: [WEB400] SQL Injection???






> From my basic understanding of how this works, the big thing is not to
dynamically build the SQL statements. Do not do:

"Select * from MyTable where MyKey = " + passedkeyfield;

Instead, make use of the host variables.

On Fri, May 30, 2008 at 8:44 AM, <Shane_Cessna@xxxxxxx> wrote:

> All:
>
> Has anyone using CGIDEV2 implemented a solution to prevent SQL Injection
> attacks in your applications?  If so, what did you use and how did you 
do
> it?
>
> This is one of my security goals for this year in case you're curious.
>
> Shane Cessna
> Senior Programmer
> North American Lighting, Inc.
> 217.465.6600 x7776
> --
> This is the Web Enabling the AS400 / iSeries (WEB400) mailing list
> To post a message email: WEB400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/web400.