The sql-injection tag has no wiki summary.
9
votes
3answers
188 views
Is there any way to break out of the string and inject SQL without using a single quote in oracle?
I'm testing an oracle based application and I've found the following code:
Query = "SELECT name FROM employees WHERE id='"+PKID+"';"
i.e. the query string contains quotes around the PKID value which ...
-1
votes
1answer
244 views
How to protect mysql database from sql-injection?
I am new to databases and security.
I am planning to put up a website.
I've read that sql-injection vulnerabilities can be very dangerous since the server might leak user passwords and ...
5
votes
2answers
181 views
Why you want to avoid Dynamic SQL in stored procedure?
I have heard one said you do not want to use Dynamic SQL. Can you give some concrete example or real-life example? Personally, I code it a few times in my database. I think it is OK because it's ...
3
votes
1answer
622 views
How can I insert smiley faces into MySQL ( 😊 )
I'm on MySQL 5.5.21, and trying to insert the '\xF0\x9F\x98\x8A' smiley face character. But for the life of me, I can't figure out how to do it.
According to various forums which I've been reading, ...
0
votes
0answers
41 views
Database security through stored procedures [duplicate]
Possible Duplicate:
Do stored procedures prevent SQL injection?
I'm curious about some database security techniques I've been learning in class recently.
Namely, I have implemented a SQL ...
7
votes
3answers
584 views
Should date formats be specified in SQL statements?
I see code from developers using implicit date conversion. I would like a definitive answer to why they should not do this.
SELECT * from dba_objects WHERE Created >= '06-MAR-2012';
1
vote
0answers
176 views
Regular Expression with UPDATE and SELECT [closed]
Want to use regular expression to execute UPDATE and SELECT query. I want to make regular expression to detect injection attack
crack
Please suggest.
5
votes
4answers
448 views
Does putting single quotation marks around numeric constants really protect from SQL injection in MySQL?
The manual seems to suggest that using quotes around numbers is sufficient to protect from SQL injection.
According to section 5.3.1. General Security Guidelines of the MySQL 5.1 Reference Manual:
...
4
votes
3answers
1k views
Building Dynamic SQL-Server Where Clause
Let us review this dba.exchange Oracle question for SQL-Server.
This is SaUce's code, after a little formatting:
CREATE PROCEDURE GetCustomer
@FirstN nvarchar(20) = NULL,
@LastN ...
45
votes
5answers
3k views
Do stored procedures prevent SQL injection?
Is it true that stored procedures prevent SQL injection attacks against PostgreSQL databases? I did a little research and found out that SQL Server, Oracle and MySQL are not safe against SQL injection ...
