|
|||||||||
|
|||||||||
| |||||||||
|
|||||||||
|
|||||||||
| |||||||||
|
|
|
| |||||||||
 |
|
|
«
Previous Thread
|
Next Thread
»
|
Thread Tools | Search this Thread | Rate Thread | Display Modes |
Dev Shed Forums Sponsor:
|
|
|
|
#1
November 7th, 2004, 06:17 PM
|
|||
|
|||
|
How to prevent SQL INJECTION?
Hi all, I've got a web based application that has a page that builds up a query depending on user selections. What I'm worried about is if evil doers decide to edit the html source to try and sql inject evil commands into the resulting sql query.
Is there a query end tag in oracle like the one in sql server? I'm quite happy for their code to cause a sql parse error, but I don't want them ending the query and then sending arbitrary commands to my database. My thinking at the moment is that if I know what to search for I can check the resulting query for escape chars or anything else that looks like it might be evil before I use it.
__________________
Like the answers I give? Why not ask me directly at my forum. I'm always glad to help. Javascript scripts and tips can be found at Dynamic Tools. Check out DynamicTable, the best javascript table sorter around. Get reliable and affordable hosting at www.thinksmarthosting.com
|
|
#2
November 8th, 2004, 03:11 AM
|
||||
|
||||
|
__________________
My blog Tutorials about OSS databases, DBMonster ... Contribute to OSS Development, fill bug reports! Developer Shed eSupport Commented my.ini/my.cnf (ADD YOUR OWN CONFIG TRICK) An introduction to database normalization Natural or Surrogate key Custom ordering for your results Correlated and uncorrelated subqueries Don't turn your outer joins into inner joins Random data (with a bias)
|
|
#3
November 8th, 2004, 05:10 PM
|
|||
|
|||
|
That makes interesting reading but doesn't actually address my specific question.
I want to know if there is a query terminating character in oracle. If they can't terminate the query they are very unlikely to produce a valid sql statement.
|
|
| Viewing: Dev Shed Forums > Databases > Oracle Development > How to prevent SQL INJECTION? |
| Thread Tools | Search this Thread |
| Display Modes | Rate This Thread |
|
|
 |
|
|
Del.icio.us
Digg
Google
Spurl
Blink
Furl
Simpy
Y! MyWeb
Linear Mode
