Programmers Quotes

Programmers' quotations about programming languages and IT

Use parameters in Dynamic SQL to prevent SQL Injection

Monday Feb 2, 2009


Tags IT Security

When using Dynamic SQL to form your SQL queries, you got to be careful when concatenating user-generated input parameters. This is because malicious hackers can put in rogue characters that mean different things to the underlying database. Specifically you need to watch out for words like “DROP TABLE” “ALTER TABLE” etc that may occur in input parameter strings. It is a good idea to keep a daily rollover log with timestamp that only has all the dynamic SQL queries being formed by an application. You can go through this at intervals to spot anything suspicious.

Using parameters is better than string concatenation, to form your Dynamic SQL queries.

Instead of this:

String strQuery = “SELECT * FROM Employees WHERE Name LIKE \’” + aName + “%\’”;

You should write something like this:

String strQuery = “SELECT * FROM Employees WHERE Name LIKE @name”;

SqlCommand cmd = new SqlCommand (strQuery);

….

cmd.Parameters.Add(“@name”, SqlDbType.VarChar).Value = aName + “%”;

This usage of parameters matching to the pre-defined data types is far safer than simple string concatenation of dynamically formed SQL queries.

VN:F [1.0.9_379]
Rating: 4.6/5 (5 votes cast)

Let’s Take a look at The IBM DB2 UDB

Tuesday Jan 27, 2009


Tags Databases

The IBM DB2 Universal Database, or (UDB), for the z/OS Version 8 and its feature, DB2 Query Management Facility, or (QMF), V8.1, became generally available during 2004. Both of them have been improved upon their predecessors and help to streamline the operation of an enterprise.

The DB2 UBD continues to deliver rich function for scalability and highly available date to your e-business applications. Combine this with the power and capacity of the zSeries platform and the z/OS, you can expect to have the ability to extend and expand your applications in this increasingly competitive on-demand environment. DB2 UBD for the z/OS allows you to make changes to the database, like adding a partition without outage, for example. There is no need to drop a re-define as you can simply altar your table and off you go.

The DB2 Utilities Suite offers some valuable tools that deliver full support for DB2 UDB for the z/OS V8. It supports features such as Unicode catalogue, long names and statements, schema evolution and indexing. The Suite also includes partitioning enhancements. Along with that, the DB2 Utility Suite comes with some improvements to its Restart that increase its autonomic capabilities and online schema support that lets reconciliation between DB2 catalogue/directory and table space.

In this release, substantial security changes have prompted the additional multi level security which provides security at a row level which improves flexibility for e-business. Applications that need more granularity security or mandatory control are addressed by row-level granularity. For those customers who need more flexible security, they can use the new special registers along with the new session variables to provide secure information to views, triggers, stored procedures and user Defined Functions. As an added bonus, new encryption options are available.

DB2 Query Management Facility V8.1
the QMF analysis package for the DB2 V8.1 provides effective visualized data in response to simple or complex business queries. The new version of QMF includes the following improvements:

* Support for the DB2 UDB V8, which includes DB2 cube views, long names, Unicode, improvements to SQL Unicode along with improvements to SQL
* Drag-and-drop building of OLAP analytics, SQL queries, pivot tables, and other business analysis reports
* Visual data “appliances,” like executive dashboards, for example, that offer unique, visually rich, interactive functionality and interfaces specific to virtually any type of information task
* Database explorer for easier browsing and identifying database assets along with any other objects they may reference
* QMF for WebSphere, that can help allow ordinary Web browsers to become zero-maintenance thin clients for visual on demand access to enterprise DB2 business data

Services

Both IBM Global Services and IBM DB2 Information Management Services provide fee-based services to help you achieve your business goals. They can supply the skills needed to help you meet your service-level expectations and achieve business success.

Consultants have the ability to assist your technicians with the migration from V7 to V8. Migration readiness assessment and technical migration are both included in IBM services for IBM DB2 V8. This includes installations, migration steps, deployment of new V8 functions, validation of data access paths and performance in compatibility mode to final migrations in Enable New Function mode, or ENF. It’s advised to carry out an IBM System Health Check to ensure a successful migration before you finish your migration project.

To summarise, on demand business in a few words mean resilient, integrated, open, virtualised and autonomic information and processing right this instant. The primary source of that resilience is improved availability, whilst integration for the DB2 is business integration. That is, connecting data, legacy systems and business applications.

VN:F [1.0.9_379]
Rating: 0.0/5 (0 votes cast)

>