freetds AT lists.ibiblio.org
Subject: FreeTDS Development Group
List archive
- From: "Bort, Paul" <pbort AT tmwsystems.com>
- To: "FreeTDS Development Group" <freetds AT lists.ibiblio.org>
- Subject: Re: [freetds] Prepared statement + date fields
- Date: Mon, 5 Jun 2006 12:39:51 -0400
> You mean e.g.:
>
> SELECT * FROM authors
> WHERE id = ?
>
> can't become:
>
> SELECT * FROM authors
> WHERE id = (select min(id) from authors)
>
> ?
>
> I don't happend to code in environments where "attacks" are a
> worry, so I
> don't usually think about such things.
>
I mean
SELECT * FROM authors WHERE id = ?
Won't do bad things if the user enters
'; GO; DELETE FROM authors; GO;
as the id (if it's a string), or
0; GO; DELETE FROM authors; GO;
if it's numeric.
But that will ruin your whole day if you're just concatenating strings.
Regards,
Paul
P.S. I don't code in an environment where attacks are a concern today,
but I'm always one firewall away from the outside world, so I like to be
safe, just in case.
-
[freetds] Prepared statement + date fields,
KERTEL - Maxime MARAIS, 06/01/2006
-
Re: [freetds] Prepared statement + date fields,
Frediano Ziglio, 06/02/2006
-
Re: [freetds] Prepared statement + date fields,
KERTEL - Maxime MARAIS, 06/02/2006
- Re: [freetds] Prepared statement + date fields, Frediano Ziglio, 06/02/2006
- Re: [freetds] Prepared statement + date fields, James K. Lowden, 06/02/2006
- Re: [freetds] Prepared statement + date fields, James K. Lowden, 06/02/2006
-
Re: [freetds] Prepared statement + date fields,
KERTEL - Maxime MARAIS, 06/02/2006
- <Possible follow-up(s)>
- Re: [freetds] Prepared statement + date fields, michael . peppler, 06/02/2006
-
Re: [freetds] Prepared statement + date fields,
Bort, Paul, 06/02/2006
- Re: [freetds] Prepared statement + date fields, KERTEL - Maxime MARAIS, 06/02/2006
- Re: [freetds] Prepared statement + date fields, James K. Lowden, 06/02/2006
- Re: [freetds] Prepared statement + date fields, Bort, Paul, 06/05/2006
-
Re: [freetds] Prepared statement + date fields,
Frediano Ziglio, 06/02/2006
Archive powered by MHonArc 2.6.24.