prevent sql injection attack in dynamic query grails -

-

मेरे पास क्वेरी है: 

  def selectQuery = "select ins" def fromQuery = " InstituteStudent ins "def whereQuery =" जहां ins.institution =: inst "def compareQuery = [inst: inst]   
 और अन्य क्वेरी के रूप में:  
  यदि (params.p.Address! = "") {WhereQuery + = "और ins.address = '" + + पता + "' 'डीईफ़ चेक = इंस्टीट्यूशनट्यूडेंट। एक्सएक्यूट (" इन्स्टिट्यूशन इंस्टीट्यूशन्स से चयन करेंइंटरसइन्स्टेसशन =: इंस्ट एंड आईएस .address = '"+ पता +"' ", [inst: inst])}   
 अग्रिम खोज क्वेरी का परिणाम  
  def allQuery = selectQuery + FromQuery + whereQuery def finalQuery = InstitutionStudent.executeQuery (allQuery.toString (), तुलना करें)   
 लेकिन इंजेक्शन हमले की संभावना है ताकि इसे रोकने के लिए इस क्वेरी से पैरामीटरेटेड क्वेरी को कैसे पारित किया जाए?   
 
 
 आप सामान्य नामित पैरामीटर का उपयोग कर सकते हैं:  
  यदि (पैरामीटर PAddress! = "") {WhereQ Uery + = "और ins.address =: पता" compareQuery.address = address def चेक = इंस्टीट्यूशन छात्र। ExecuteQuery ("इंस्टीट्यूशनल इंस्टीट्यूशन इंस्टीट्यूट्स से इन्फोस इनस्टेक्शन =: inst और ins.address =: address", [inst: inst , पता: पता])}

Comments

Post a Comment

Popular posts from this blog

asp.net - Procedure or function "Procedure name" expects a parameter "Param name" which was not supplied occurs rarely -

-
I have a VB Net has a web service function that will send criteria to an SQL server stored function. Everything works perfectly for two months in the deployment machine. but now error The process or function GetEmployeeDetails is expected to have a parameter @progress which was not supplied 'P> posted on the machine Just came once. Everything works fine before and after the error. Web service code: public function GetLocation (ByVal as the oldNumber integer, ByVal integer as NewNumber, ByVal as the location string, Byval progress form In the form of a string, byVal name as string, byVal ID as string, try the string as Command1 = New SqlCommand ("GetEmployeeDetails" Connection1) with Command1. CommonType = CommandType Stored Surechers Parameter.ed ("@ old number", SQLDB type.int). Value = old number. Parameter.ed ("New Numer", SQLDB type.ins). Value = Newamer. Parameter. Add ("@Space", SQLBT Ype.VarChar, 10). Value = loc...
Read more

jsp - No mapping found for HTTP request with URI with annotation config Spring MVC and Jetty -

-
Image
I'm only using annotation configuration, the server starts, but when I use some pages error is displayed: Warning: no mapping found for HTTP request with URI [/WEB-INF/view/main.jsp] name 'org.springframework.web.servlet.DispatcherServlet -D7259e with DispatcherServlet in Controller mapping works fine, but no JSP page is full. I am using Jetty 9.2.0.M0 and Spring MVC 4.0.4 release. JetTyP Config: Private Static Last String CONTEXT_PATH = "/"; Private Static Last String MAPPING_URL = "/ *"; Private Zero Server (Int port) throws exceptions {server server = new server (port); Server.addLifeCycleListener (New LifeCycleListener ()); Server.setHandler (getServletContextHandler (getContext ())); Server.start (); Server.join (); } Private static ServletContextHandler getServletContextHandler (WebApplicationContext context) throws IOException {LOGGER.info ( "ServletContextHandler is ready"); CircleContaxHandler themeHandler = new circactont...
Read more

sql server ce - Is there some way to make sqlce3.5 and 4.0 co-exist in the C# project -

-
Currently, my user needs to downgrade their database from sqlce4.0 to sqlce3.5 for our application. , I found a post and it basically caters to my requirement except that the user needs intervention of both solutions, ideally I will target this target to automatically (i.e. users To create without any interference) I want to code a small tool to achieve this goal. So my idea is: 1. Since I know the schema of this DB, so I make an Sclc 3.5 empty DB first. 2. Then open the old SQL 4.0 db and the new escrow 3.5 db at the same time. , And then ask sqlce4.0 DB from the table table and insert them into the new sqlce3.5 dB. It sounds good, but when I try with the C # project, it seems that it can only add an SKL accessory reference (either V5 or V4.0). I know this ninth place has improved pollution. But how can I solve it? 3. Or if I have to export the data to the SQL file and then import it into SQL 3D DD? If some console utility is to impede which supports importing SQL data in sqlce...
Read more