Mailing-List: contact user-help@ignite.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@ignite.apache.org
MIME-Version: 1.0
In-Reply-To: <1503299887306-16321.post@n6.nabble.com>
References: <1503299887306-16321.post@n6.nabble.com>
From: Alexey Kukushkin <kukushkinalexey@gmail.com>
Date: Mon, 21 Aug 2017 13:30:06 +0300
Message-ID: <CA+vFNSog+No5NJbFiDGc7s1nFp_BuA_FCebdXoCDbwsiS3xyKQ@mail.gmail.com>
Subject: Re: sql Injection prevention in ignite
To: user@ignite.apache.org
Content-Type: multipart/alternative; boundary="001a114198cc6d4875055740f620"
archived-at: Mon, 21 Aug 2017 10:30:12 -0000

--001a114198cc6d4875055740f620
Content-Type: text/plain; charset="UTF-8"

Hi,

Yes, Ignite prevents SQL injection.

Also, I think PreparedStatement is not about preventing you from SQL
injection. PreparedStatement is about compiling a query so that it can be
efficiently re-used if executed multiple times. What prevents form SQL
injection is binding parameters instead of concatenating them and making
them part of the SQL. If you check
IgniteH2Indexing.preparedStatementWithParams() you would find that this is
exactly what Ignite does - it binds parameters to the statement.

On Mon, Aug 21, 2017 at 10:18 AM, kotamrajuyashasvi <
kotamrajuyashasvi@gmail.com> wrote:

> Hi
>
> Using PreparedStatement of JDBC we can avoid/prevent sql Injection. Does
> *SqlFieldsQuery.setArgs(..)* in ignite also have same functionality to
> prevent sql Injection or Are there any other ways to prevent sql Injection
> in ignite.
>
>
>
>
> --
> View this message in context: http://apache-ignite-users.
> 70518.x6.nabble.com/sql-Injection-prevention-in-ignite-tp16321.html
> Sent from the Apache Ignite Users mailing list archive at Nabble.com.
>


-- 
Best regards,
Alexey

--001a114198cc6d4875055740f620
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi,<div><br></div><div>Yes, Ignite prevents SQL injection.=
</div><div><br></div><div>Also, I think PreparedStatement is not about prev=
enting you from SQL injection. PreparedStatement is about compiling a query=
 so that it can be efficiently re-used if executed multiple times. What pre=
vents form SQL injection is binding parameters instead of concatenating the=
m and making them part of the SQL. If you check IgniteH2Indexing.preparedSt=
atementWithParams() you would find that this is exactly what Ignite does - =
it binds parameters to the statement.=C2=A0</div></div><div class=3D"gmail_=
extra"><br><div class=3D"gmail_quote">On Mon, Aug 21, 2017 at 10:18 AM, kot=
amrajuyashasvi <span dir=3D"ltr">&lt;<a href=3D"mailto:kotamrajuyashasvi@gm=
ail.com" target=3D"_blank">kotamrajuyashasvi@gmail.com</a>&gt;</span> wrote=
:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-le=
ft:1px #ccc solid;padding-left:1ex">Hi<br>
<br>
Using PreparedStatement of JDBC we can avoid/prevent sql Injection. Does<br=
>
*SqlFieldsQuery.setArgs(..)* in ignite also have same functionality to<br>
prevent sql Injection or Are there any other ways to prevent sql Injection<=
br>
in ignite.<br>
<br>
<br>
<br>
<br>
--<br>
View this message in context: <a href=3D"http://apache-ignite-users.70518.x=
6.nabble.com/sql-Injection-prevention-in-ignite-tp16321.html" rel=3D"norefe=
rrer" target=3D"_blank">http://apache-ignite-users.<wbr>70518.x6.nabble.com=
/sql-<wbr>Injection-prevention-in-<wbr>ignite-tp16321.html</a><br>
Sent from the Apache Ignite Users mailing list archive at Nabble.com.<br>
</blockquote></div><br><br clear=3D"all"><div><br></div>-- <br><div class=
=3D"gmail_signature" data-smartmail=3D"gmail_signature"><div dir=3D"ltr">Be=
st regards,<div>Alexey</div></div></div>
</div>

--001a114198cc6d4875055740f620--