Re: user arguments, oracle - insert, delete and drop!

2008-01-14 Thread John W. Krahn
perlmunky wrote: On Jan 11, 2008 6:47 PM, Chris Charley <[EMAIL PROTECTED]> wrote: See this colimn by Randal L. Schwartz. It descibes injection attacks. http://www.stonehenge.com/merlyn/UnixReview/col58.html Thanks, I read the page, alongside the wikipedia page and I think I understand what a

Re: user arguments, oracle - insert, delete and drop!

2008-01-14 Thread perlmunky
On Jan 11, 2008 6:47 PM, Chris Charley <[EMAIL PROTECTED]> wrote: > > See this colimn by Randal L. Schwartz. It descibes injection attacks. > http://www.stonehenge.com/merlyn/UnixReview/col58.html > > Thanks, I read the page, alongside the wikipedia page and I think I understand what an sql inject

Re: user arguments, oracle - insert, delete and drop!

2008-01-11 Thread Chris Charley
- Original Message - From: "perlmunky" <[EMAIL PROTECTED]> Newsgroups: perl.beginners To: Sent: Friday, January 11, 2008 9:11 AM Subject: user arguments, oracle - insert, delete and drop! Hi List, I am in the process of making a web service which will (at some p

Re: user arguments, oracle - insert, delete and drop!

2008-01-11 Thread Tom Phoenix
On Jan 11, 2008 9:43 AM, <[EMAIL PROTECTED]> wrote: > I have written some stuff - I am just concerned that people on the > big bad web know far more about these things (oracle - perl) than I > and that they will, with little trouble, side-step my parameter > checking. So, show us your code; and

Re: user arguments, oracle - insert, delete and drop!

2008-01-11 Thread Tom Phoenix
On Jan 11, 2008 6:11 AM, perlmunky <[EMAIL PROTECTED]> wrote: > I realise that this is not smart, at least without any parameter checking. > I need a way of making the information 'safe' - avoid sql injections etc. > hints, tips and solutions accepted :) Have you tried writing Perl code to do th

user arguments, oracle - insert, delete and drop!

2008-01-11 Thread perlmunky
Hi List, I am in the process of making a web service which will (at some point) query an oracle DB with some user supplied text. Currently the page allows the user to select the information in the insert from a tick box, the tables from a list and the conditional they can choose and then enter as