[freetds] Prepared statement + date fields

Bort, Paul pbort at tmwsystems.com
Mon Jun 5 12:39:51 EDT 2006


> You mean e.g.:
> 
> 	SELECT * FROM authors 
> 	WHERE id = ?
> 
> can't become:
> 
> 	SELECT * FROM authors 
> 	WHERE id = (select min(id) from authors)
> 
> ?
> 
> I don't happend to code in environments where "attacks" are a 
> worry, so I
> don't usually think about such things. 
> 

I mean

SELECT * FROM authors WHERE id = ?

Won't do bad things if the user enters 

'; GO; DELETE FROM authors; GO;

as the id (if it's a string), or

0; GO; DELETE FROM authors; GO;

if it's numeric. 

But that will ruin your whole day if you're just concatenating strings.

Regards,
Paul

P.S. I don't code in an environment where attacks are a concern today,
but I'm always one firewall away from the outside world, so I like to be
safe, just in case.


More information about the FreeTDS mailing list