Quantcast
Channel: SCN: Message List - SAP Adaptive Server Enterprise (SAP ASE) for Custom Applications
Viewing all articles
Browse latest Browse all 3587

Re: How To Use Escape Characters to Prevent SQL Injection

$
0
0

Frankly I am not sure I understand the question or if there is a typo in the question. So I will go with my best understanding. If that's not correct it might help if you spell out an example of final queries that you are sending to database server.

 

My understanding from your examples is what you are trying to do is return all rows when no parameter is passed by your user (i.e. 1=1 ) and return only rows with specific value when parameter is passed by your user(i.e. tableA.columnA = 'AB')

 

If that's the correct statement of the problem then you might try this approach.

 

if object_id('test') is not null
    drop table test
go
create table test (id int identity,
                        col1 varchar(30))
go
insert into test values('value1')
insert into test values('value2')
insert into test values('value3')
insert into test values('value4')
insert into test values('value5')
insert into test values('value6')
go
--variable not passed or null. Return all rows.
declare @string varchar(30)
SELECT * FROM dbo.test where col1 =@string or @string is null
go
--variable is a specific value. Return specific rows.
declare @string varchar(30)
select @string='value3'
SELECT * FROM dbo.test where col1 =@string or @string is null
go

In both cases the query remains the same and you do not need to frame the sql dynamically.

Of course your problem statement may be really different from my understanding. 

 

warm regards,
sudhir

 

Message was edited by: sudhir dubey


Viewing all articles
Browse latest Browse all 3587

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>