Building Reliable Solutions to Avoid SQL Injection

Improper value management and assignment can lead to security issues related to SQL injection. Although it is not directly evident, it can cause significant problems if bind variables or other sanitization techniques are not used. Unfortunately, most people do not realize this situation and live with the incorrect assumption that the date and time values cannot be the root of the SQL injection. They put the character string sequence of individual elements representing date and time values into the command definition. However, then, the provided value is converted into a DATE or TIMESTAMP value automatically and evaluated. But there is a risk: automated conversion.

Often, date and time values are not considered security holes. They consist of individual elements, and the format is precisely specified, so where is the problem? Which parameters affect the format and representation? The session DATE and TIMESTAMP formats impact the...