Mailing-List: contact dev-help@click.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@click.apache.org
Received-SPF: pass (nike.apache.org: domain of sabob1@gmail.com designates
 209.85.160.42 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:user-agent:mime-version:to:subject:references
         :in-reply-to:content-type:content-transfer-encoding;
        b=BuoS0NFVwDWzqj9PL6DFw9Caw+/h06mslR7cPOWsio+kIqJrg4v2XFpwRQEy0dGbXa
         eUNe2xLKA+6Iw7t5qYcmc3RBbtG8XV8PkaMvN01s8nJz+gXLLRSVA+MowfRKoZ5Wu36K
         m/y4y75v5/V8grH8Y+soK9Gcft+c+HmSzVox0=
Message-ID: <4BB06ECE.5060108@gmail.com>
Date: Mon, 29 Mar 2010 20:11:42 +1100
From: Bob Schellink <sabob1@gmail.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US;
 rv:1.9.1.8) Gecko/20100227 Thunderbird/3.0.3
MIME-Version: 1.0
To: dev@click.apache.org
Subject: Re: How sure is Click agains SQL injections?
References: <1269783017320-4813027.post@n2.nabble.com>
In-Reply-To: <1269783017320-4813027.post@n2.nabble.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Hi George,

ORMs like Hibernate/JPA/Cayenne take care of SQL injection by using prepared statements. If you use 
raw JDBC you should use prepared statements as well.

See the defense strategies mention here:
   http://www.owasp.org/index.php/Preventing_SQL_Injection_in_Java


kind regards

bob

On 29/03/2010 12:30 AM, georgex wrote:
>
> How sure is Click against SQL injections?
> I mean a typical Click application like Click-Examples - but without Spring
> (where the average programmer doesn't add an extra layer of checking - but
> it's using Click as default).
>
> Thanks,
> George.