mirrors/eiffel-org
1
0
Fork 0
mirror of https://github.com/EiffelSoftware/eiffel-org.git synced 2025-12-06 23:02:28 +01:00
Code Issues Packages Projects Releases Wiki Activity

Missing space.

Browse Source 
Updated wikipage Defending against SQL injections with EiffelStore.
	(Signed-off-by:javier).

git-svn-id: https://svn.eiffel.com/eiffel-org/trunk@2086 abb3cda0-5349-4a8f-a601-0c33ac3a8c38
This commit is contained in:
eiffel-org
2018-10-11 20:09:40 +00:00
parent 1bcad7d4f4
commit f0722d6639
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
documentation/18.07/solutions/database-access/eiffelstore/EiffelStore-SQL-injection.wiki
View File

@@ -1,3 +1,5 @@
[[Property:modification_date|Thu, 11 Oct 2018 20:09:39 GMT]]
[[Property:publication_date|Thu, 11 Oct 2018 20:09:39 GMT]]
[[Property:link_title|SQL injection]]
[[Property:uuid|438C838C-C115-44B4-8480-05A825FE1047]]
[[Property:weight|4]]
@@ -57,8 +59,7 @@ The following example shows an attempt to do an SQL Injection attack, but as we
end
</code>
As you can observe in the previous example the binding to map the variable name <code>:datetime</code> to their value is done
using feature <code> BD_SELECTION.set_map_name</code> and the API is responsible to do the necessary encoding.
As you can observe in the previous example the binding to map the variable name <code>:datetime</code> to their value is done using feature <code> BD_SELECTION.set_map_name</code> and the API is responsible to do the necessary encoding.
=== Unsafe binding ===
If you use your own binding to map variables names to values, for example using String replacement, EiffelStore does not ensure that your query is safe, because it will depend on how do you handle escaping inputs before adding them to the query.