Jimmy .. you can use any value you want to name your Primary key ..When I create all my Sql Tables I use the name of the table +EID .. example I have a table names "User" .. so the primary key I would create would be "UserEID"
Totally you choice on how to name your primary key .. ps I do not use the "Auto" incremating feature .. I create my Primary key values myself .. Auto incremating Primary keys lend themselves to Sql Injection attacks ..
Rick
does Fivewin use Name "id" as default also for "other" SQL :?:Yes, by default for autoincrement primary field.
Auto incremating Primary keys lend themselves to Sql Injection attacksdid you have a Sample to show the Problem :?:
Jimmy
I create my own primary keys that way I control when a table is appended .. if you use auto increment an attacker could force an table append or "Inject" records into your tables and the database doesn't care .. the primary keys are generated automatically .. for me I create ALL my primary keys programmatically to is someone infiltrates my database security and tries to create ne records or "Inject" ( append ) records they will fail because there is no primary key and the injection fails ..
Just something to keep in mind .. .
Rick Lipkin wrote:JimmyI am not fully convinced.
I create my own primary keys that way I control when a table is appended .. if you use auto increment an attacker could force an table append or "Inject" records into your tables and the database doesn't care .. the primary keys are generated automatically .. for me I create ALL my primary keys programmatically to is someone infiltrates my database security and tries to create ne records or "Inject" ( append ) records they will fail because there is no primary key and the injection fails ..
Just something to keep in mind .. .
//-------------------
Static Func _GenEid()
// generate a unique primary key
LOCAL nRAND,cRand
LOCAL oRs, cSQL, oERR
oRs:= TOleAuto():New( "ADODB.Recordset" )
oRs:CursorType := 1 // opendkeyset
oRs:CursorLocation := 3 // local cache
oRs:LockType := 3 // lockoportunistic
cSQL := "SELECT UserEid from UserInfo"
TRY
oRs:Open( cSQL,xCONNECT )
CATCH oErr
MsgInfo( "Error in Opening USERINFO table to Create Unique EID" )
RETURN("BOGUS")
END TRY
DO WHILE .T.
nRAND := nRANDOM(10000000000000000)
// 1 is reserved and 0 is a null key //
IF nRAND = 1 .or. nRAND = 0 .or. nRAND = NIL
LOOP
ENDIF
cRAND := STR(nRAND,17)
IF oRs:eof
ELSE
oRs:MoveFirst()
oRs:Find("UserEid = '"+cRAND+"'" )
ENDIF
IF oRs:eof
EXIT
ELSE
LOOP
ENDIF
EXIT
ENDDO
oRs:Close()
oRs := nil
RETURN( cRAND )I am not asking how do generate unique primary key.
I am asking for an example of an FWH program, using which SQLI (sql injection) is possible.
Rao .. I do not have an answer .. My "primary key procedure" is more of a preventative measure to keep attackers (from using whatever means) to hack my tables and covertly insert rows .
Rick Lipkin
It all depends on our program.
Not on autoinc keys
We will discuss about SQLI after a few days.