Mailing-List: contact user-java-help@ibatis.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user-java@ibatis.apache.org
Received-SPF: pass (asf.osuosl.org: local policy)
Date: Sat, 09 Jul 2005 21:14:10 -0600
From: Nathan Maves <Nathan.Maves@Sun.COM>
Subject: Re: R: [HELP] Whether or not iBatis support SQL Injection?
In-reply-to: <a10a823c05070506014b7c92eb@mail.gmail.com>
Sender: Nathan.Maves@Sun.COM
To: user-java@ibatis.apache.org
Message-id: <20514A00-D847-46BD-B49E-5791CEDB3118@sun.com>
MIME-version: 1.0
Content-type: text/plain; charset=ISO-8859-1; delsp=yes; format=flowed
Content-transfer-encoding: quoted-printable
References: <007c01c5814a$867bcaf0$6405a8c0@anhtuan>
 <20050705110232.09C0B10FB2B9@asf.osuosl.org>
 <a10a823c05070506014b7c92eb@mail.gmail.com>

I was asked the question "What is SQL injection and how can I avoid it?"

I understand it to a point but an example would be great.

Nathan

On Jul 5, 2005, at 7:01 AM, Larry Meadors wrote:

> Yes, it does pass the SQL directly to the driver, but unless you use
> the $$ syntax for parameters, you should be safe with iBATIS.
>
> The $$ syntax is the only part of iBATIS that allows string
> concatenation, which is the biggest source of SQL injection attacks.
>
> If you are using a really crappy jdbc driver, you could have issues
> with it somehow botching things in it's implementation of prepared
> statements, but I have not heard of a single case of that happening.
>
> Larry
>
>
> On 7/5/05, Fabrizio Gianneschi =20
> <fabrizio.gianneschi@gruppoatlantis.com> wrote:
>
>>
>> Since iBatis uses PreparedStatements a lot, it's safer than old =20
>> school JDBC
>> code, even if it's still vulnerable because it passes the SQL =20
>> directly to
>> the driver without checking, afaik. You can always use some good =20
>> tricks to
>> increase the robustness of your SQL, but...
>>
>> ...this type of checking is not responsibility of a SQL mapper =20
>> layer like
>> iBATIS.
>> I think you should check your user input in higher server side =20
>> layers, such
>> as the presentation one; Struts Actions and/or ActionForms, for =20
>> example.
>>
>> Fab
>>
>>  ________________________________
>>  Da: Pham Anh Tuan [mailto:anhtuan@ichi-corp.jp]
>> Inviato: marted=EC 5 luglio 2005 12.16
>> A: iBatis
>> Oggetto: [HELP] Whether or not iBatis support SQL Injection?
>>
>>
>>
>> Hi all,
>>
>> I don't know whether or not iBatis support checking SQL Injection =20
>> or not ?
>>
>> plz help me :)
>>
>> Pham
>