Timeline for Validating user supplied input
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 1, 2015 at 6:23 | comment | added | Mathieu Guindon | I don't know what tool you're using, and I've never used such a code inspection tool (R# suffices for my needs) - I don't know how such a tool figures out the flaws, but I don't think it would, indeed. IMHO whatever validation you add might work, but is just lipstick on a pig: I believe the key point is that the SQL command string is being tampered with as a feature, when the idea of a parameterized query is to avoid replacements and concatenations. | |
| Jun 1, 2015 at 5:31 | vote | accept | NJMR | ||
| Jun 1, 2015 at 5:31 | comment | added | NJMR | Thanks for the answer. Well I noted your points. I also discussed the same with my superior. What my Superior is saying is to add validation in the AddDataFrom method to validate the query. But what I think is, adding validation in that method wont fix the flaw reported by tool. Am I right? | |
| May 29, 2015 at 14:20 | history | answered | Mathieu Guindon | CC BY-SA 3.0 |