DBLoad, any potential security issues? Possible SQL injection?

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

JohnFlyTN@gmail.com - 23 Jan 2008 19:51 GMT

Is there any potential (security)risk to loading data with dbload?

example :

unchecked delimited text input -> dbload command file

command file simply

FILE data.txt DELIMITER '|' 3;

INSERT INTO test
(
text1,
text2,
text3
)
VALUES (f01,f02,f03);

What (if any) risks are there here? Is there any way for a malicious
user to embed SQL commands inside the delimited text input?

Reply to this Message

Art S. Kagel (Oninit LLC) - 23 Jan 2008 19:57 GMT

> Is there any potential (security)risk to loading data with dbload?
>
[quoted text clipped - 17 lines]
> user to embed SQL commands inside the delimited text input?
>

They can embed anything that they want, it's just text data and it will
simply be inserted into the table, not executed. There are no know
security problems with dbload. It's a venerable and reliable tool.

Art S. Kagel
Oninit

===========================================================================================
Please access the attached hyperlink for an important electronic communications disclaimer:

http://www.oninit.com/home/disclaimer.php

===========================================================================================

Reply to this Message