Groups > comp.lang.java.programmer > #28461

Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys

Date	2014-05-13 20:43 -0400
From	Arne Vajhøj <arne@vajhoej.dk>
Newsgroups	comp.lang.java.programmer
Subject	Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys
References	<slrnlb8jo8.42s.avl@gamma.logic.tuwien.ac.at> <a20d7c0f-6838-4cc6-9d5e-b2914a78f941@googlegroups.com> <53702d7b$0$293$14726298@news.sunsite.dk> <5370f6f5$0$6711$9b4e6d93@newsspool3.arcor-online.net>
Message-ID	<5372bc46$0$295$14726298@news.sunsite.dk> (permalink)
Organization	SunSITE.dk - Supporting Open source

Show all headers | View raw

On 5/12/2014 12:29 PM, Marcel Müller wrote:
> On 12.05.14 04.10, Arne Vajhøj wrote:
>> Allowing multiple SQL statements in a single execute can make
>> SQL injection much worse.
>
>> I would consider it a security flaw.
>
> I do not agree.
>
> Code that passes user input as part of SQL code to a database is broken
> by design, not the database driver that can execute more than one
> statement.

If SQL injection happens then there is certainly a bug in
the application code.

But good software design does not assume that all other code
is implemented correctly.

So you:
* configure mod_security in Apache to check for injection attempts
* validate input in PL
* store data in strongly typed objects in BLL
* use prepared statements in DAL
* use a JDBC driver that does not allow multiple statements to be 
executed in one call
* configure database security of that the connections has minimal priviliges

To defend against SQL injections in depth.

> And on the other side there could be good reasons execute multiple
> statements as a block. Preferably performance issues.

For INSERT/UPDATE/DELETE you can do it safely in JDBC via batch.

If the same functionality was needed for SELECT then add SELECT support
in batch would be safer than allowing multiple statements in one call.

Arne

Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@gamma.logic.tuwien.ac.at> - 2013-12-20 14:07 +0000
  Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys lipska the kat <"lipskathekat at yahoo dot co dot uk"> - 2013-12-20 16:29 +0000
    Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-03-05 14:10 +0000
      Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys lipska the kat <lipskathekat@example.com> - 2014-03-05 20:34 +0000
        Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-03-11 15:04 +0000
      Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2014-03-11 20:02 -0400
        Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@auth.logic.tuwien.ac.at> - 2014-03-12 00:13 +0000
  Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-20 19:08 -0500
    Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Robert Klemme <shortcutter@googlemail.com> - 2013-12-21 10:15 +0100
      Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-21 10:59 -0500
        Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Robert Klemme <shortcutter@googlemail.com> - 2013-12-21 17:14 +0100
          Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-21 12:19 -0500
    Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arved Sandstrom <asandstrom2@eastlink.ca> - 2013-12-21 14:59 -0400
      Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-21 15:04 -0500
        Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arved Sandstrom <asandstrom2@eastlink.ca> - 2013-12-21 18:56 -0400
          Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-21 18:33 -0500
            Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@gamma.logic.tuwien.ac.at> - 2013-12-22 11:24 +0000
  Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-20 19:14 -0500
    Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@gamma.logic.tuwien.ac.at> - 2013-12-21 09:43 +0000
      Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Joerg Meier <joergmmeier@arcor.de> - 2013-12-21 11:59 +0100
      Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-21 09:15 -0500
        Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@gamma.logic.tuwien.ac.at> - 2013-12-21 21:43 +0000
          Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-21 17:34 -0500
            Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@gamma.logic.tuwien.ac.at> - 2013-12-22 00:47 +0000
              Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-21 20:10 -0500
                Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-21 22:45 -0500
                Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@gamma.logic.tuwien.ac.at> - 2013-12-22 10:59 +0000
                Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-22 20:09 -0500
                Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Andreas Leitgeb <avl@gamma.logic.tuwien.ac.at> - 2013-12-22 11:08 +0000
    Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Robert Klemme <shortcutter@googlemail.com> - 2013-12-21 11:46 +0100
      Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2013-12-21 13:44 -0500
  Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys firstsql@gmail.com - 2014-03-12 20:23 -0700
    Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2014-05-11 22:10 -0400
      Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Marcel Müller <news.5.maazl@spamgourmet.org> - 2014-05-12 18:29 +0200
        Re: JDBC: getMoreResults() versus rs.next() & autoGeneratedKeys Arne Vajhøj <arne@vajhoej.dk> - 2014-05-13 20:43 -0400

csiph-web