Portable SQL/Common/DBMS Differences - Revision history

Nose: removed backlink

2008-06-22T13:05:43Z

removed backlink

2007-05-17T14:25:34Z

2007-05-13T11:42:43Z

2007-05-06T16:51:32Z

header hierarchy

2007-04-27T20:16:15Z

‎Quotes and numeric values

2007-03-10T18:16:29Z

‎Quotes and numeric values

2007-03-10T18:16:07Z

‎Quotes and numeric values

2007-03-10T16:47:43Z

‎NULL in column definition

2007-03-10T16:45:39Z

‎Quotes and numeric values

2006-09-04T14:40:55Z

‎Identifiers

← Older revision		Revision as of 13:05, 22 June 2008
Line 83:		Line 83:

	Special care must be taken in this case to avoid SQL injection attacks. Please read the section about [[Portable_SQL - Quoting#Quoting_values\|quoting values]] carefully!		Special care must be taken in this case to avoid SQL injection attacks. Please read the section about [[Portable_SQL - Quoting#Quoting_values\|quoting values]] carefully!
−
−
−	~~----~~
−	~~Back to [[OpenDBX\|Overview]]~~

← Older revision		Revision as of 16:51, 6 May 2007
Line 1:		Line 1:
	__TOC__		__TOC__
−
−
−	~~= Differences between implementations =~~

	== Identifiers ==		== Identifiers ==

@@ Line 85: / Line 85: @@
   INSERT INTO table (floatval,string) VALUES (-3.14,'some text')
-Special care must be taken in this case to avoid SQL injection attacks. Please read the section about [[OpenDBX_Portable_SQL#Quoting_values|quoting values]] carefully!
+Special care must be taken in this case to avoid SQL injection attacks. Please read the section about [[Portable_SQL - Quoting#Quoting_values|quoting values]] carefully!
 ----
 Back to [[OpenDBX|Overview]]

@@ Line 85: / Line 85: @@
   INSERT INTO table (floatval,string) VALUES (-3.14,'some text')
-Special care must be taken in this case. Please read the section about [[OpenDBX_Portable_SQL#Quoting_values|quoting values]] carefully!
+Special care must be taken in this case to avoid SQL injection attacks. Please read the section about [[OpenDBX_Portable_SQL#Quoting_values|quoting values]] carefully!
 ----
 Back to [[OpenDBX|Overview]]

@@ Line 85: / Line 85: @@
   INSERT INTO table (floatval,string) VALUES (-3.14,'some text')
-Nevertheless, also numerical values should be passed to the escape function of the database library first to avoid SQL injection attacks.
+Special care must be taken in this case. Please read the section about [[OpenDBX_Portable_SQL#Quoting_values|quoting values]] carefully!
 ----
 Back to [[OpenDBX|Overview]]

← Older revision	Revision as of 14:25, 17 May 2007
(No difference)

← Older revision	Revision as of 11:42, 13 May 2007
(No difference)

@@ Line 47: / Line 47: @@
 {| class="wikitable" style="text-align:center"
-! Database !! Default value !! Definition allowed !! Notes
+! Database !! Default !! Definition allowed !! Notes
 |-
 ! Firebird

@@ Line 77: / Line 77: @@
 == Quotes and numeric values ==
-MS SQL Server and Sybase ASE doesn't allow single quotes (') around numeric values (integer and floating point values), for example
+MS SQL Server and Sybase ASE doesn't allow single quotes (') around numeric values (integer, decimal and floating point values), for example
   INSERT INTO table (floatval,string) VALUES ('-3.14','some text')
@@ Line 85: / Line 85: @@
   INSERT INTO table (floatval,string) VALUES (-3.14,'some text')
-This gets tricky if the values are supplied by a user. You must validate the input to be sure it is a numeric value and you can't use the escape() function. Otherwise, if you don't look at the input, your application will be vulnerable to SQL injection and you will be in deep trouble.
+Nevertheless, also numerical values should be passed to the escape function of the database library first to avoid SQL injection attacks.
 ----
 Back to [[OpenDBX|Overview]]

@@ Line 15: / Line 15: @@
 |-
 ! MySQL
-| 63 || L,NL,D,_,$ || preserved ||
+| 64 || L,NL,D,_,$ || preserved ||
 |-
 ! Oracle