What is SQL Injection? It is a code injection technique, where a malicious SQL statements are inserted into an entry field for execution. This can happen if SQL filters or a completely embedded SQL query are being used.

A sample SQL injection is shown using a unique filter. The sample can be found in a file called sql-injections.txt that is found in the workspace.
By filtering on “ ‘) or (‘ ‘=’ “ in the application a user can view guest user messages that should be private.
To prevent these attacks, Squeaks have been added to DataFlex.
In the DataFlex Studio, expand ‘WebApp.src’ in the ‘Workspace Explorer’ panel on the right, expand ‘Web Views,’ and double click ‘SqueakSelect.wo.’
The filter within SqueakSelect.wo sends a rebuilt constraint that has been built in the constraints. It is necessary to make sure the filter is properly escaped, and their functions for that in the Data Dictionary.
Searching for “SQLescape” in the help will show ‘SQLEscapedStr’ function in the Data Dictionary. This, and several other functions found in the help, can be used.
This use of this function will not be demonstrated in this lesson because it is simple to implement, but it is extremely important that it is used because there is a severe security risk without it.

Security the Basics

DataFlex courses

Information

Security the Basics

Lesson 5: SQL injection