SQL Injection techniques

張貼者 於

SQL Injection techniques

Security should be foremost on every database developer’s mind, and given a little thought and know-how, it’s not difficult to develop fairly secure code. The only trouble is that it’s VERY easy to develop code which can be exploited in some way, maybe with disastrous results.

This article isn’t about database security in general, that’s far too big a subject to cover in a few pages of XHTML, but about a specific issue which is probably the most common database and application exploit.

張貼者 於

ORACLE-BASE – DBMS_ASSERT – Sanitize User Input to Help Prevent SQL Injection

DBMS_ASSERT – Sanitize User Input to Help Prevent SQL Injection
The DBMS_ASSERT package was introduced in Oracle 10g Release 2 and backported to Release 1 in the Oracle October 2005 Critical Patch Update. There are currently no references to this package in the 10g Release 2 documentation or on Metalink. The package contains a number of functions that can be used to sanitize user input and help to guard against SQL injection in applications that don’t use bind variables.

Performance of Collections

張貼者 於

Object Relational Features

Performance of Collections
So, how do collections measure up in terms of performance? We’ve already seen that they can be used to greatly simplify coding within PL/SQL (and into other environments as well), but are they quick?

Well, they can be, but they may also be a serious performance problem, if certain considerations are not understood. The following sections highlight a typical problem and various solutions.

Using ROWNUM
It’s a common trick, but referencing rownum within a sub-query causes Oracle to materialize the results into temp (otherwise known as “preventing query merging taking place"). How does this help with collection performance? Well, consider the following example :

Filter Subqueries « Oracle Scratchpad

張貼者 於

Filter Subqueries « Oracle Scratchpad

Filter Subqueries
Filed under: Hints, Performance, Troubleshooting, Tuning — Jonathan Lewis @ 11:33 pm UTC Nov 6,2006

Here’s a little demonstration of a feature that can cause random fluctuations in performance because of an unlucky data item. It starts with an emp table holding 20.000 employees spread across six departments, and then moves one employee to a new (carefully chosen) department. You will have to run this in version 9i or later, as it makes use of subquery factoring to generate the emp table.

張貼者 於

yangtingkun : 利用Oracle的bug进行测试——UNNEST提示的测试记录

利用Oracle的bug进行测试——UNNEST提示的测试记录
===========================================================
作者: yangtingkun(http://yangtingkun.itpub.net)
发表于: 2005.05.14 23:53
分类: ORACLE
出处: http://yangtingkun.itpub.net/post/468/29830
—————————————————————

UNNEST提示告诉优化器将子查询转化为连接的方式。不过，UNNEST操作似乎是Oracle优化器的默认选项，因此，很难看出UNNEST提示是否起作用。