<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	xmlns:georss="http://www.georss.org/georss" xmlns:geo="http://www.w3.org/2003/01/geo/wgs84_pos#" xmlns:media="http://search.yahoo.com/mrss/"
	>

<channel>
	<title>Avoid SQL Injection</title>
	<atom:link href="http://avoidsqlinjection.wordpress.com/feed/" rel="self" type="application/rss+xml" />
	<link>http://avoidsqlinjection.wordpress.com</link>
	<description>Avoid SQL Injection Oracle Database</description>
	<lastBuildDate>Fri, 12 Sep 2008 07:52:55 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.com/</generator>
<cloud domain='avoidsqlinjection.wordpress.com' port='80' path='/?rsscloud=notify' registerProcedure='' protocol='http-post' />
<image>
		<url>http://s2.wp.com/i/buttonw-com.png</url>
		<title>Avoid SQL Injection</title>
		<link>http://avoidsqlinjection.wordpress.com</link>
	</image>
	<atom:link rel="search" type="application/opensearchdescription+xml" href="http://avoidsqlinjection.wordpress.com/osd.xml" title="Avoid SQL Injection" />
	<atom:link rel='hub' href='http://avoidsqlinjection.wordpress.com/?pushpress=hub'/>
		<item>
		<title>5. Filtering Input with DBMS_ASSERT</title>
		<link>http://avoidsqlinjection.wordpress.com/2008/09/12/5-filtering-input-with-dbms_assert/</link>
		<comments>http://avoidsqlinjection.wordpress.com/2008/09/12/5-filtering-input-with-dbms_assert/#comments</comments>
		<pubDate>Fri, 12 Sep 2008 07:52:55 +0000</pubDate>
		<dc:creator>Ferry Setiawan</dc:creator>
				<category><![CDATA[5. Filtering Input with DBMS_ASSERT]]></category>

		<guid isPermaLink="false">http://avoidsqlinjection.wordpress.com/?p=97</guid>
		<description><![CDATA[To guard against SQL injection in applications that do not use bind arguments with dynamic SQL, you must filter and sanitize concatenated strings. The primary use case for dynamic SQL with string concatenation is when an Oracle identifier (such as table name) is unknown at code compilation time. The DBMS_ASSERT package contains a number of [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=avoidsqlinjection.wordpress.com&amp;blog=4783465&amp;post=97&amp;subd=avoidsqlinjection&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://avoidsqlinjection.wordpress.com/2008/09/12/5-filtering-input-with-dbms_assert/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
	
		<media:content url="http://0.gravatar.com/avatar/e3b37103279427baaff1c4640cf60df8?s=96&#38;d=wavatar&#38;r=G" medium="image">
			<media:title type="html">ferrysetiawan</media:title>
		</media:content>

		<media:content url="http://avoidsqlinjection.wordpress.com/images/bullet2.gif" medium="image" />

		<media:content url="http://avoidsqlinjection.wordpress.com/images/bullet2.gif" medium="image" />

		<media:content url="http://avoidsqlinjection.wordpress.com/images/bullet2.gif" medium="image" />

		<media:content url="http://avoidsqlinjection.wordpress.com/images/bullet2.gif" medium="image" />
	</item>
		<item>
		<title>5.1 Overview of DBMS_ASSERT</title>
		<link>http://avoidsqlinjection.wordpress.com/2008/09/12/51-overview-of-dbms_assert/</link>
		<comments>http://avoidsqlinjection.wordpress.com/2008/09/12/51-overview-of-dbms_assert/#comments</comments>
		<pubDate>Fri, 12 Sep 2008 07:52:24 +0000</pubDate>
		<dc:creator>Ferry Setiawan</dc:creator>
				<category><![CDATA[.   5.1 Overview of DBMS_ASSERT]]></category>

		<guid isPermaLink="false">http://avoidsqlinjection.wordpress.com/?p=95</guid>
		<description><![CDATA[DBMS_ASSERT is an Oracle-supplied PL/SQL package containing seven functions. While two of these functions can be used to filter and sanitize any input string, the majority of them are specifically crafted to validate Oracle identifiers. Function Description NOOP Does not perform any validation and returns the string unchanged. Allows developers to mark some data as [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=avoidsqlinjection.wordpress.com&amp;blog=4783465&amp;post=95&amp;subd=avoidsqlinjection&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://avoidsqlinjection.wordpress.com/2008/09/12/51-overview-of-dbms_assert/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
	
		<media:content url="http://0.gravatar.com/avatar/e3b37103279427baaff1c4640cf60df8?s=96&#38;d=wavatar&#38;r=G" medium="image">
			<media:title type="html">ferrysetiawan</media:title>
		</media:content>
	</item>
		<item>
		<title>5.2 Format Oracle Identifiers</title>
		<link>http://avoidsqlinjection.wordpress.com/2008/09/12/52-format-oracle-identifiers/</link>
		<comments>http://avoidsqlinjection.wordpress.com/2008/09/12/52-format-oracle-identifiers/#comments</comments>
		<pubDate>Fri, 12 Sep 2008 07:50:17 +0000</pubDate>
		<dc:creator>Ferry Setiawan</dc:creator>
				<category><![CDATA[.   5.2 Format Oracle Identifiers]]></category>

		<guid isPermaLink="false">http://avoidsqlinjection.wordpress.com/?p=93</guid>
		<description><![CDATA[To use DBMS_ASSERT effectively, you need to understand how Oracle identifiers can be specified and used. In a SQL statement, you specify the name of an object with an unquoted identifier or a quoted identifier. An unquoted (or internal format) identifier is not surrounded by any punctuation. It must begin with a letter and may [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=avoidsqlinjection.wordpress.com&amp;blog=4783465&amp;post=93&amp;subd=avoidsqlinjection&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://avoidsqlinjection.wordpress.com/2008/09/12/52-format-oracle-identifiers/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
	
		<media:content url="http://0.gravatar.com/avatar/e3b37103279427baaff1c4640cf60df8?s=96&#38;d=wavatar&#38;r=G" medium="image">
			<media:title type="html">ferrysetiawan</media:title>
		</media:content>
	</item>
		<item>
		<title>5.3 Work with Identifiers in Dynamic SQL</title>
		<link>http://avoidsqlinjection.wordpress.com/2008/09/12/53-work-with-identifiers-in-dynamic-sql/</link>
		<comments>http://avoidsqlinjection.wordpress.com/2008/09/12/53-work-with-identifiers-in-dynamic-sql/#comments</comments>
		<pubDate>Fri, 12 Sep 2008 07:48:37 +0000</pubDate>
		<dc:creator>Ferry Setiawan</dc:creator>
				<category><![CDATA[.   5.3 Work with Identifiers in Dynamic SQL]]></category>

		<guid isPermaLink="false">http://avoidsqlinjection.wordpress.com/?p=91</guid>
		<description><![CDATA[When working with identifiers in dynamic SQL statements you must first determine: Where will the input be coming from &#8212; user or data dictionary? What verification is required: does the object need to exist? what type of identifier is it &#8212; basic, simple, or qualified SQL name? How will the result be used &#8212; as [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=avoidsqlinjection.wordpress.com&amp;blog=4783465&amp;post=91&amp;subd=avoidsqlinjection&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://avoidsqlinjection.wordpress.com/2008/09/12/53-work-with-identifiers-in-dynamic-sql/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
	
		<media:content url="http://0.gravatar.com/avatar/e3b37103279427baaff1c4640cf60df8?s=96&#38;d=wavatar&#38;r=G" medium="image">
			<media:title type="html">ferrysetiawan</media:title>
		</media:content>
	</item>
		<item>
		<title>5.4 Choose a Verification Routine</title>
		<link>http://avoidsqlinjection.wordpress.com/2008/09/12/54-choose-a-verification-routine/</link>
		<comments>http://avoidsqlinjection.wordpress.com/2008/09/12/54-choose-a-verification-routine/#comments</comments>
		<pubDate>Fri, 12 Sep 2008 07:43:30 +0000</pubDate>
		<dc:creator>Ferry Setiawan</dc:creator>
				<category><![CDATA[.   5.4 Choose a Verification Routine]]></category>

		<guid isPermaLink="false">http://avoidsqlinjection.wordpress.com/?p=89</guid>
		<description><![CDATA[Once you determine the type of identifier you need to verify, the following table helps you select the appropriate verification routine: Identifier Type Verification Basic Restrict application to use only basic SQL names by applying an algorithm similar to this Simple DBMS_ASSERT.SIMPLE_SQL_NAME Qualified DBMS_ASSERT.QUALIFIED_SQL_NAME Database Link Use DBMS_ASSERT.QUALIFIED_SQL_NAME if you only need to filter input. [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=avoidsqlinjection.wordpress.com&amp;blog=4783465&amp;post=89&amp;subd=avoidsqlinjection&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://avoidsqlinjection.wordpress.com/2008/09/12/54-choose-a-verification-routine/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
	
		<media:content url="http://0.gravatar.com/avatar/e3b37103279427baaff1c4640cf60df8?s=96&#38;d=wavatar&#38;r=G" medium="image">
			<media:title type="html">ferrysetiawan</media:title>
		</media:content>
	</item>
	</channel>
</rss>
