Timeline for Security issues in a SQL query and possible function?
Current License: CC BY-SA 3.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 23, 2017 at 12:41 | history | edited | CommunityBot |
replaced http://stackoverflow.com/ with https://stackoverflow.com/
|
|
| Aug 14, 2014 at 16:19 | comment | added | rolfl | Comments are not the place for tutorials, discussions and general chatter. Please take this to a chat room, you are welcome to join The 2nd Monitor at any time | |
| Aug 14, 2014 at 16:18 | comment | added | Ian Ringrose | @Malachi, I meant the definition of the columns in a table. | |
| Aug 14, 2014 at 16:16 | comment | added | Malachi | you are getting off the topic of the question @IanRingrose, an update is an update whether it is called from the VB code or from the database, the database will handle which order they happen in, and if it is a big deal that information can be handled inside the stored procedure when it is written. the rest are all select statements and concurrency isn't an issue with viewing data, which no matter where you call it from could be obsolete data the next second anyway. databases hold information let them handle that part of it. database says "I got this" | |
| Aug 14, 2014 at 16:06 | comment | added | Ian Ringrose | Saying that “version control is done by DB backup” tells me all I need to know about you level of understanding of version control. Version control is hard for databases, e.g. how to you do merges when two developers change the same table in different branches? | |
| Aug 14, 2014 at 16:05 | comment | added | RubberDuck | The access database would only be backed up if the server has a file back up process. The access database is really just a fancy flat file. | |
| Aug 14, 2014 at 16:02 | comment | added | Malachi | @IanRingrose you should have a separation of concerns, Data and Presentation. that is accepted by the majority of programmers. one way or the other you shouldn't have SQL in your VB. what is the VB going to do with it? VB is going to send the SQL to the DB, why send more information than you need to. version control is something that SQL databases have figured out by back ups. not sure how that works on Access though. | |
| Aug 14, 2014 at 15:58 | comment | added | Ian Ringrose | Stored procs are often not the best answer, as they are harder too version control then the application code, along with lots of other issues. Some people love them, some people hate them, but telling someone to use them without understanding their complete development process is not good advice. | |
| Aug 14, 2014 at 14:43 | comment | added | Malachi | it's not good structure, you want to keep your database code on your database, you will still parameterize the input when you use stored procedures as well. you want the database to handle the data, the VB to handle gathering input and displaying output. the database is the box, VB is the Hand that reaches into the box or puts things in the box. | |
| Aug 14, 2014 at 14:38 | comment | added | Sifu | @Phrancis Don't parametrized queries protect from that type of injection? (Assuming they could input such texts in the textboxes (I am validating the textboxes input server-side, but I want to make sure it is safe even if it didn't have these validations)) Well, anyway, I am currently following Malachi's advice and creating Stored Procedures in Access. But I am still curious : Don't parameterized queries block these type of injections? | |
| Aug 14, 2014 at 14:31 | comment | added | Phrancis |
@Sifu: what if my user name was: Phrancis; DELETE FROM Login; ?
|
|
| Aug 14, 2014 at 14:08 | comment | added | Malachi | @Sifu, you don't want to risk it. you are exposing your database to the world, someone out there knows how to exploit the vulnerabilities of your code, so make sure that you don't have many for them to work with. Get into the habit of writing nearly impenetrable code | |
| Aug 14, 2014 at 14:05 | history | edited | Malachi | CC BY-SA 3.0 |
added link
|
| Aug 14, 2014 at 14:01 | comment | added | Sifu | Is it possible to make stored procedures on ms-Access 2010? Is it possible to inject my queries as it stands (Paramterized queries)? | |
| Aug 14, 2014 at 13:59 | history | answered | Malachi | CC BY-SA 3.0 |