Mailing-List: contact user-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Struts Users Mailing List" <user@struts.apache.org>
Received-SPF: pass (athena.apache.org: domain of paulus.benedictus@gmail.com
 designates 209.85.219.48 as permitted sender)
MIME-Version: 1.0
Sender: paulus.benedictus@gmail.com
In-Reply-To: <514CEB0A.2000701@gmail.com>
References: <514CEB0A.2000701@gmail.com>
Date: Fri, 22 Mar 2013 23:58:34 -0500
Message-ID: 
 <CABLGb9z-XLAM1LjDv-rU+thXD2DsouSUYH4ykH_+LgvHQDg5QA@mail.gmail.com>
Subject: Re: Struts 1.3 : Preventing SQL Injection (form.field validation)
From: Paul Benedict <pbenedict@apache.org>
To: Struts Users Mailing List <user@struts.apache.org>
Content-Type: multipart/alternative; boundary=bcaec54c4e008223de04d8906cb1

--bcaec54c4e008223de04d8906cb1
Content-Type: text/plain; charset=ISO-8859-1

If you use JDBC prepared statements, you will not have to worry about SQL
injection.

Paul

On Fri, Mar 22, 2013 at 6:36 PM, J.V. <jvsrvcs@gmail.com> wrote:

> Does anyone out there have a method I could use to pass a form field
> variable that would check for all known SQL injection vulnerabilities (with
> regards to the form field only, irrespective of the method of SQL
> execution) and return a true/false if it passes the test?
>
> I have about 100+ forms ( 500+ fields) to validate for SQL injection
> vulnerabilities and was thinking of creating an abstractForm.java class and
> putting the validate method there and calling that in each of the
> MyForm.java classes validate() method.
>
> I thought initially it would be better to move everything over to use
> Apache commons validator, create a global rule and simply apply the global
> rule to every form field but it may be better to take this approach.
>
> Any thoughts on the approach or a validator classs to pattern match the
> field would be helpful (if you have had such a case in the past).
>
> thanks
>
> J.V.
>
> ------------------------------**------------------------------**---------
> To unsubscribe, e-mail: user-unsubscribe@struts.**apache.org<user-unsubscribe@struts.apache.org>
> For additional commands, e-mail: user-help@struts.apache.org
>
>

--bcaec54c4e008223de04d8906cb1--