C# Discussion Boards - CodeProject

Re: Regular Expression to check for Oracle reserved words and special characters & sql injection attacks

15-Jul-11 1:21

Hi
I have searched the internet and I have been able to find a regular expression that stops users from inputting into a text box words that Oracle uses as reserved words, or characters that it considers special to it unless they are enclosed in quotes along with a regular expression that detects sql injection attacks. Can anyone help?

BobJanova15-Jul-11 2:26

BobJanova

15-Jul-11 2:26

Use parameterised queries, unless there is a good reason not to. If there is a good reason not to, escape input on the server side when making up the query. Validating input fields in this way is one of the worst ways to prevent attacks (because it stops users entering legitimate information).

Re: Regular Expression to check for Oracle reserved words and special characters & sql injection attacks

Member 297299215-Jul-11 2:45

Re: Regular Expression to check for Oracle reserved words and special characters & sql injection attacks

15-Jul-11 2:45

We are in a way undertaking a parameterised queries. I am actually building a query tool in wpf and restricting what sort of queries a user can run. All I am trying to do is where a user sets a constraint, such name like = 'Bob', that they cannot enter a reserved word or use it to launch an attack. This is why I am looking for a regular expression!

BobJanova15-Jul-11 3:56

BobJanova

15-Jul-11 3:56

But what if the user's name includes a banned character (e.g. O'Donnell)? I'm sure there are a few people with surnames that are database reserved words, too. This is why you should escape whatever is passed to you so it isn't an injection string, not 'validate' in such a way that legitimate user input is excluded.

Producing a safe SQL string is relatively easy if what you're escaping is always going to be a quoted parameter, you need to escape quotes, and a good idea to do semicolons for paranoia too.

Re: Regular Expression to check for Oracle reserved words and special characters & sql injection attacks

GuyThiebaut15-Jul-11 2:50

Re: Regular Expression to check for Oracle reserved words and special characters & sql injection attacks

15-Jul-11 2:50

If you are using PHP at the front end this is a very helpful tutorial:

Clickety[^]

The generally accepted advice is to escape non alphanumeric characters in text entry boxes and

mysql_real_escape_string()

should do the job for you if it is PHP at the front end...

Continuous effort - not strength or intelligence - is the key to unlocking our potential.(Winston Churchill)

Member 297299215-Jul-11 2:57

Re: Regular Expression to check for Oracle reserved words and special characters & sql injection attacks

15-Jul-11 2:57

It is WPF or windows presentation foundation in c# with an Oracle 10g database not php and mysql

GuyThiebaut15-Jul-11 3:33

Re: Regular Expression to check for Oracle reserved words and special characters & sql injection attacks

15-Jul-11 3:33

Check this out:

oracle_sql_injection_attacks[^]

It is also the responsibility of the DBA to ensure that, whatever you pass in to Oracle, you are not able to create an injection attack - so talk this over with the DBA too.

Continuous effort - not strength or intelligence - is the key to unlocking our potential.(Winston Churchill)

Member 297299215-Jul-11 4:16

Re: Regular Expression to check for Oracle reserved words and special characters & sql injection attacks

15-Jul-11 4:16

We have already done this, but what we are doing is creating a query tool that runs against a query database that is copy of the main database. The users queries run against some views, because the users can create any number of combination of queries against these views it is not possible to binding or any of the usual stuff. Therefore, we have to be as flexible as possible. We control what they can select on and join on with the views but we cannot control their constraints such "name Like "Bob".

Therefore, it is imperative for me to have away of stopping "Bob; 'DROP TABLE'" type situations.

GuyThiebaut18-Jul-11 2:45

Re: Regular Expression to check for Oracle reserved words and special characters & sql injection attacks

18-Jul-11 2:45

Hi,

Just wanted to let you know that it is not me down-voting you comments.

I hope you find a solution, when you do let us know Smile | :)

Continuous effort - not strength or intelligence - is the key to unlocking our potential.(Winston Churchill)

PIEBALDconsult15-Jul-11 3:21

PIEBALDconsult

15-Jul-11 3:21

One of the problems will be having to keep it up to date.

Something that's easy to do is to see if the string contains multiple statements separated by semi-colons;
see my LibSql.SplitSqlStatements method in here[^].

Problem with messagequeue

prasadbuddhika15-Jul-11 1:19

prasadbuddhika

15-Jul-11 1:19

in my application i create a msmq , before creating the queue i check for existence and if exist delete it and then create, this works fine, but sometimes i get an exception saying "access denied" a security exception.
when creating the msmq i assign the permission too for the local user through "environment.user"

but still i get this exception ,

appreciate your ideas about this .

thanks in advance.

Getting Rows That Was Changed

AmbiguousName15-Jul-11 1:00

AmbiguousName

15-Jul-11 1:00

hello guys... I want to get a row from the table that was changed but got no clue what to do? Here is what I tried butcertainly it not working

SqlCommand cmd = new SqlCommand();
cmd.CommandType = CommandType.StoredProcedure;
cmd.CommandText = "StoredProcedure";

DataTable dt = this.GetDataTable(cmd); //a local function which returns DataTable
string row = st.RowChanged

Re: Getting Rows That Was Changed

DaveAuld15-Jul-11 1:16

DaveAuld

15-Jul-11 1:16

Well this depends on what you mean by Changed.

Did you make the change to the current dataset and haven't yet posted (committed) the changed?

You last looked at a table last week, and you want to now whats changed since then?

You have a dataset open, and you want to know some else had changed something with the dataset?

Please explain what you are trying to do and then the answers will hopefully come.......

Dave
Find Me On: Web|Facebook|Twitter|LinkedIn

Folding Stats: Team CodeProject

Re: Getting Rows That Was Changed [modified]

AmbiguousName15-Jul-11 1:29

AmbiguousName

15-Jul-11 1:29

Lets suppose that I changed the City from London to Paris of a particular record OR a number of records using some C# app. Now I want to get this/these rows.

modified on Friday, July 15, 2011 7:37 AM

Re: Getting Rows That Was Changed [modified]

DaveAuld15-Jul-11 1:41

DaveAuld

15-Jul-11 1:41

Ok, Lets assume that it is a current recordset that you hold;

First determine if there are changes: http://msdn.microsoft.com/en-us/library/czb9z269(v=VS.100).aspx[^]

Then, determine which rows have changed;
http://msdn.microsoft.com/en-us/library/thc1eetk.aspx[^]

The problem lies if you have committed the changes into the database for the current dataset, in which case these methods wont help, and you will probably need to rely on some custom change tracker based on timestamps.

Edit: How To: Custom Change Tracker[^]

Dave
Find Me On: Web|Facebook|Twitter|LinkedIn

Folding Stats: Team CodeProject

modified on Friday, July 15, 2011 7:56 AM

Re: Getting Rows That Was Changed

GuyThiebaut15-Jul-11 2:07

Only show decimals if there are any

15-Jul-11 2:07

Is your table stored in a datawarehouse i.e. is it a type2 warehouse etc?

If it is a datawarehouse you are accessing the data from then it should be a simple(read simple to complicated here) matter of looking at the expired date and effective date columns of rows...

Continuous effort - not strength or intelligence - is the key to unlocking our potential.(Winston Churchill)

Etienne_12314-Jul-11 22:09

Etienne_123

14-Jul-11 22:09

Hi
Is it possible to have a variable ONLY show decimals if it does have decimal values? E.g. if the value comes back grom the database as 500 then instead of showing 500.00, it should just show 500. If it comes back as 500.55, then it should show 500.55. Please note that I do not want to use string formatting here as I want to retain the decimal type for sorting purposes.

Etienne_12314-Jul-11 22:24

Etienne_123

14-Jul-11 22:24

So I found a way of doing this. If you use Decimal.ToDouble it seems to do the job Smile | :)

Shameel15-Jul-11 2:00

Shameel

15-Jul-11 2:00

Converting your Decimal value to Double may result in loss of precision. Instead, keep it Deciamal and use ToString() to display it in a certain format.

Wayne Gaylard14-Jul-11 22:32

Wayne Gaylard

14-Jul-11 22:32

I am not sure which version of .Net you are using but in VS 2010(.Net 4.0) in a winforms app, this seems to be the default behaviour. I know if I want to always show the decimal part (500.00), that is when I need to go the ToString route. I just tested with a listbox and with textboxes, and I get no decimal points if the decimal is a whole number.

...and I have extensive experience writing computer code, including OIC, BTW, BRB, IMHO, LMAO, ROFL, TTYL.....

GuyThiebaut14-Jul-11 22:55

14-Jul-11 22:55

From a general programming point of view you should never change your data type to satisfy display requirements, if by changing that datatype you remove precision.

Converting to a double will lose some precision.
Although very little precision is generally lost - if you are performing financial calculations this can cause a problem further on down the line when figures do not match.

So it really is better to stick with decimal and then to format it for display - otherwise you may be asking for trouble later when the FD asks "Why don't the totals match?"...

Continuous effort - not strength or intelligence - is the key to unlocking our potential.(Winston Churchill)

Wayne Gaylard14-Jul-11 23:23

Wayne Gaylard

14-Jul-11 23:23

Hear, Hear.

...and I have extensive experience writing computer code, including OIC, BTW, BRB, IMHO, LMAO, ROFL, TTYL.....