I have a Stored Procedure which gets 6 input queries and the inputs are the same as where clause
of a query. For instance where x=1 and z=5 and e=4
. The Application makes these input strings and pass it onto my procedure.This is a part of my procedure in which I'm checking the inputs in order to validate the content of each input query so that they do not contain keywords like "select", "update", "delete" or equivalents.I want to know whether there are better ways to do that.
create or replace procedure app_error_test(query1 nvarchar2,
query2 nvarchar2,
query3 nvarchar2,
query4 nvarchar2,
query5 nvarchar2,
query6 nvarchar2) is
queryconcat nvarchar2(30000);
begin
--**************** validate content of input queries
queryconcat := lower(nvl(query1, '') || nvl(query2, '') ||
nvl(query3, '') || nvl(query4, '') ||
nvl(query5, '') || nvl(query6, ''));
if (queryconcat like '%drop%' or
queryconcat like '%delete%' or
queryconcat like '%execute%' or
queryconcat like '%truncate%' or
queryconcat like '%create%' or
queryconcat like '%update%' or
queryconcat like '%insert%') then
RAISE_APPLICATION_ERROR(-20032, 'ILLEGAL CONTENT');
end if;
end;
Thanks in advance