or is there some primary resources i can read and learn.
thanks.
I’m doing an audit of a system, which the developers insist is SQL injection proof. This they achieve by stripping out the single-quotes in the login form – but the code behind is not parameterized; it’s still using literal SQL like so:
username = username.Replace("'", "");
var sql = "select * from user where username = '" + username + "'";
Is this really secure? Is there another way of inserting a single quote, perhaps by using an escape character? The DB in use is Oracle 10g.
oracle has a good reputation for handling large-scale applications and it’s also flexible to extend to cluster environment. Why everyone wants NOSQL?
because nosql db is much cheaper?
why not swith object-oriented db?
How can I create dump file of Oracle (10g) DB, or backup Oracle DB on linux OS?
I have a web application that will be distributed over 2 servers and the Database will be on a server other than the 2 servers. so application on each server will access database exists in another server.I am using caching in the application and when data changed the cache is cleared and the problem now how each server will feel with cache changes on the other server?
I have tried SQLCache dependency before and i have heard about Memchache, Velocity and Enterprise cache so which one will be more efficient and optimal for this case? and i have another solution to create webservice method on each application and when the cache is cleared in one application it will request the webservice method on the other application to clear cache there.
Which technique is more efficient and optimal in performance and security? and is SQLCache dependency related to SQL database only or can be applicable to other databases like Oracle?
Note: I am using load balancer to distribute requests coming for the application among the 2 server
Thanks in advance
My current knowledge:
I am especially interested in answers for MySQL, Informix and DB2.
I used to use mysql, and in mysql database hold tables, but these concepts doesn’t apply to oracle, so I don’t quite understand the differences.
Update: The problem I am facing is, I need to do immigration from Mysql to Oracle.
I have two switching databases called A and B, in Mysql all the tables are in their corresponding databases.
In mysql database is a logical concept, it use database to hold tables, in oracle database is physical concept, I don’t know how to design this in oracle.
Do I need to use “CREATE DATABASE” to create two databases in oracle to achieve the same effect?
There is the following table: event_table, which contains information about object_name, event_number, event_supplementary_info, event_time. I would like to have a sql query, which shows number of events per last seven day daily and total number.
I know the sql query, which shows total number of events per object, but I need to add granulity of number of events per day
select object_name,
event_number,
count(*),
event_supplementary_info
from event_table
where event_time between to_char((sysdate) -7, 'YYYY-MM-DD'))
and to_char((sysdate) , 'YYYY-MM-DD'))
group by object_name, event_number, event_supplementary_info;
Can you please help?
Hi all,
I have a Oracle linked server (10.g) on a Sql server 2005.
Trying to Import oracle table schema(s) into SQL using
Select * into ttdsls030010 from openQuery(hades,'select * from baan.ttdsls030010 where rownum =1');
This throws an Error converting data type DBTYPE_DBTIMESTAMP to datetime
Is there a way to autocast Oracle type to Sql type ?