Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #28448

Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys

Date 2014-05-12 18:29 +0200
From Marcel Müller <news.5.maazl@spamgourmet.org>
Newsgroups comp.lang.java.programmer
Subject Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys
References <slrnlb8jo8.42s.avl@gamma.logic.tuwien.ac.at> <a20d7c0f-6838-4cc6-9d5e-b2914a78f941@googlegroups.com> <53702d7b$0$293$14726298@news.sunsite.dk>
Message-ID <5370f6f5$0$6711$9b4e6d93@newsspool3.arcor-online.net> (permalink)
Organization Arcor

Show all headers | View raw

On 12.05.14 04.10, Arne Vajhøj wrote:
> Allowing multiple SQL statements in a single execute can make
> SQL injection much worse.

> I would consider it a security flaw.

I do not agree.

Code that passes user input as part of SQL code to a database is broken 
by design, not the database driver that can execute more than one statement.

And on the other side there could be good reasons execute multiple 
statements as a block. Preferably performance issues.


Marcel

Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@gamma.logic.tuwien.ac.at> - 2013-12-20 14:07 +0000
  Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys lipska the kat <"lipskathekat at yahoo dot co dot uk"> - 2013-12-20 16:29 +0000
    Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-03-05 14:10 +0000
      Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys lipska the kat <lipskathekat@example.com> - 2014-03-05 20:34 +0000
        Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-03-11 15:04 +0000
      Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2014-03-11 20:02 -0400
        Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-03-12 00:13 +0000
  Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-20 19:08 -0500
    Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Robert Klemme <shortcutter@googlemail.com> - 2013-12-21 10:15 +0100
      Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-21 10:59 -0500
        Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Robert Klemme <shortcutter@googlemail.com> - 2013-12-21 17:14 +0100
          Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-21 12:19 -0500
    Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arved Sandstrom <asandstrom2@eastlink.ca> - 2013-12-21 14:59 -0400
      Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-21 15:04 -0500
        Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arved Sandstrom <asandstrom2@eastlink.ca> - 2013-12-21 18:56 -0400
          Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-21 18:33 -0500
            Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@gamma.logic.tuwien.ac.at> - 2013-12-22 11:24 +0000
  Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-20 19:14 -0500
    Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@gamma.logic.tuwien.ac.at> - 2013-12-21 09:43 +0000
      Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Joerg Meier <joergmmeier@arcor.de> - 2013-12-21 11:59 +0100
      Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-21 09:15 -0500
        Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@gamma.logic.tuwien.ac.at> - 2013-12-21 21:43 +0000
          Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-21 17:34 -0500
            Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@gamma.logic.tuwien.ac.at> - 2013-12-22 00:47 +0000
              Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-21 20:10 -0500
                Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-21 22:45 -0500
                Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@gamma.logic.tuwien.ac.at> - 2013-12-22 10:59 +0000
                Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-22 20:09 -0500
                Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@gamma.logic.tuwien.ac.at> - 2013-12-22 11:08 +0000
    Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Robert Klemme <shortcutter@googlemail.com> - 2013-12-21 11:46 +0100
      Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-21 13:44 -0500
  Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys firstsql@gmail.com - 2014-03-12 20:23 -0700
    Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2014-05-11 22:10 -0400
      Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Marcel Müller <news.5.maazl@spamgourmet.org> - 2014-05-12 18:29 +0200
        Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2014-05-13 20:43 -0400

csiph-web