Question
You have a been put in charge of a Web application backed by a SQL Server database. There has been no input validation done to
You have a been put in charge of a Web application backed by a SQL Server database. There has been no input validation done to protect the web application or database from SQL Injection. You've been placed in charge of fixing this problem The Web App has a search field that pull's photo's from the database as well as the photo info based on the search string. Your task is to provide examples of how this Web App Search function can be protected. Additionally, the company is considering moving to Oracle as the back end DB. Please create a solution for the possible move to Oracle as well. The existing query built into the web app is: SELECT image.image, image.image_info WHERE image.image_info LIKE %" + searchTerm + '1%"; You may assume the web app is programmed in whatever language you feel most comfortable working in. Explain why the existing query is problematic. Give the parameterized query you suggest moving to (in your chosen language). Give a an example of a stored procedure to solve the problem for SQL Server AND one for Oracle as well. Write one paragraph about what you learned from this exercise as well as how both parameterized queries and stored procedures can help protect the application and database.
Step by Step Solution
There are 3 Steps involved in it
Step: 1
Get Instant Access to Expert-Tailored Solutions
See step-by-step solutions with expert insights and AI powered tools for academic success
Step: 2
Step: 3
Ace Your Homework with AI
Get the answers you need in no time with our AI-driven, step-by-step assistance
Get Started