normally when you select in database you need a keyword. So when selecting you just append the keyword and do a select. For wild card select query I am wondering if adding * directly in the input search field is safe from sql injection. Example user needs to type into select box keyword then click search button
@Sami glad to hear that. @dwir182 Hope I have expressed my question properly please clarify if not clear enough
no @WhatsThePoint it will be select * from table where column like 'variable' because variable will already look like * keyword * . That is why im wondering if it is a safe practice
yes im still getting the correct/expected result @dwir182 im just worried that it might be a disaster when it comes to sql injection especially if user has knowledge in programming they know that searching for * keyword * means wild card search
@dwir182 when selecting query will be like this SELECT * FROM users WHERE name = 'keyword' right? to do wild card you will go SELECT * FROM users WHERE name = '%keyword%' right? in my case I will require user to have * in the search field like when you search for USA you need to type in search field * USA * then click search
SQL injection is a code injection technique, used to attack data-driven applications, in which nefarious SQL statements are inserted into an entry field for execution
i mean like if user can do * keyword * ' UNION ..... because there is * i thought that it will be start if all is safe then thank you everyone for your time in looking into my question
I will be asking more question Im hoping you guys will still answer them in the future thank you again
yes @dwir182 thank you very much I think my problem is my understading with sql injection sometimes I just dont understand things and associate other things. ENglish isnt my native tongue so I have problem sometimes understanding especially if the words a seldom used thanks again mate
Hello! I have 3 tables: Persons, Laptops, Phones. Each person owns a number of laptops and phones. Now I want to output a table showing for each person how many laptops and phones they own. Example: John, 2, 1; Anna, 3, 2; etc. My unsuccessful attempt: SELECT COUNT(*) FROM Laptops, Phones WHERE PersonId IN (SELECT PersonId FROM Persons). I guess I need some more advanced SQL concept here, would you mind telling me what kind of query could solve my problem? Thanks!
SELECT personID,
count(la.laptopID),
count(ph.phoneID)
FROM persons pe
JOIN laptops la on la.personID = pe.personID
JOIN phones ph on ph.personID = p.personID
group by personID
Wonderful! Thanks @Andrew it works as intended, I tried adding more persons with various numbers of laptops and phones. I will study the query and experiment by myself :-)
Ive learned something today thanks @Andrew by the way is there a sign that you are getting the cartesian effect ? or you need to determine it manually?
e.g. a ->b and a->c - can cartesian, while a->b and b->c won't in a sense
@guradio - I am rarely the one who created the database, learning / understanding the data model implemented is usually one of the first things you have to do to be effective on a system
hahahahahaha well i could bookmark but im not using my PC right now is there a way or i need to just search sql room? there might be other rooms Im afraid i need to check one by one :)
I have a checkbox and recyclerview. I have to update list related to recyclerview on checkbox change
if checkbox ticked state Select Query like
SELECT *
FROM tbl_code
WHERE isFavourite = 1
else unticked state Select Query like
SELECT *
FROM tbl_code
Is this valid question for SO. Closed or ........? Tagged -> sql server https://stackoverflow.com/questions/32573256/ssrs-bids-2008-unable-to-load-the-credentials-type-is-not-in-the-serialization [NATO]
Hi all. I somehow locked myself out of my postgresql db. I was using pgadmin4 and changed the password of the default user postgre to something different but now I can't use anything and always get the error invalid password, but it never asks me to actually enter a password.
Ok got it. I had to disconnect from the server. And not under servers in general but under the specific server. Super weird that it doesn't automatically kick you off when you try to do something with a wrong password
Is it a feature or a bug that the primary key counter get's incremented even when no value was added into the db because the code never reached conn.commit()
I have now one entry in a table with the id 15, I thought it should be one
Yeah I know it doesn't matter. It's one just not pretty and two this means two dbs won't be in the same state even though they could have gone through the same process... this points does sound more alarming
why would it be complex? Just have a counter and update it only after commit?