Mailing-List: contact chukwa-dev-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: chukwa-dev@hadoop.apache.org
Message-ID: <2002211688.1242170565606.JavaMail.jira@brutus>
Date: Tue, 12 May 2009 16:22:45 -0700 (PDT)
From: "Mac Yang (JIRA)" <jira@apache.org>
To: chukwa-dev@hadoop.apache.org
Subject: [jira] Commented: (CHUKWA-108) Use prepared statement to prevent
 sql injection attacks
In-Reply-To: <1106709343.1239223933278.JavaMail.jira@brutus>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/CHUKWA-108?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12708684#action_12708684 ] 

Mac Yang commented on CHUKWA-108:
---------------------------------

this is for trunk

> Use prepared statement to prevent sql injection attacks
> -------------------------------------------------------
>
>                 Key: CHUKWA-108
>                 URL: https://issues.apache.org/jira/browse/CHUKWA-108
>             Project: Hadoop Chukwa
>          Issue Type: Improvement
>          Components: Data Processors
>            Reporter: Eric Yang
>            Assignee: Eric Yang
>         Attachments: CHUKWA-108.patch
>
>
> To prevent SQL Injection attacks, you should use prepared statements. There are many places where the SQL query is executed and in atleast a couple of places the input parameter from the user is used in the query. (metric in web/hicc/jsp/single-series-chart-javascript.jsp") though in many places the parameters in the select statement do not seem to come from the user input.
> Please use prepared statement consistently to prevent sql injection attacks.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.