Skip to Content.
Sympa Menu

freetds - Re: [freetds] Prepared statement + date fields

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "Bort, Paul" <pbort AT tmwsystems.com>
  • To: "FreeTDS Development Group" <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] Prepared statement + date fields
  • Date: Mon, 5 Jun 2006 12:39:51 -0400

> You mean e.g.:
>
> SELECT * FROM authors
> WHERE id = ?
>
> can't become:
>
> SELECT * FROM authors
> WHERE id = (select min(id) from authors)
>
> ?
>
> I don't happend to code in environments where "attacks" are a
> worry, so I
> don't usually think about such things.
>

I mean

SELECT * FROM authors WHERE id = ?

Won't do bad things if the user enters

'; GO; DELETE FROM authors; GO;

as the id (if it's a string), or

0; GO; DELETE FROM authors; GO;

if it's numeric.

But that will ruin your whole day if you're just concatenating strings.

Regards,
Paul

P.S. I don't code in an environment where attacks are a concern today,
but I'm always one firewall away from the outside world, so I like to be
safe, just in case.




Archive powered by MHonArc 2.6.24.

Top of Page