×
The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.
Are SQL injection attacks
really a big issue using CGIDEV2?
The "language" used has nothing to do with the issue of SQL Injection.
If you're concatenating values from your website into a string to send
to the sql engine (DB2, Oracle, SQLServer, MySQL, etc.) it's an issue.
And don't forget, that applies to values from your site regardless of
how they're entered on the page. I've seen people who protect the input
text boxes, but don't worry about the drop-down lists with the argument
that the drop-down lists are controlled from the server. Then I show
them fiddler and the ability to change the post-values on the fly and
that argument goes out the window.
Don't forget, SQL Injection isn't something that happens by accident.
It's highly unlikely that your average end-user is going to accidently
enter something that causes the issue (single quotes not withstanding).
SQL Injection is usually an honest hack-attempt by someone that know
what they're doing, and has the tools to do it.
-Walden
midrange.com
