Dynamic SQL Execution in Oracle (PL / SQL) and Security

Question

If I have a valid SQL string; I can still execute it in my PL / SQL, but I guarantee that it is a SELECT statement only ... without complicated parsing to make sure it does not have any escape characters / nested commands or any of these jazz?

EDIT:

What I'm really trying to accomplish is a generic query tool built into my application. It has a friendly, domain-specific graphical interface and allows a very non-technical user to create fairly complex queries. The tool handles version search, adds internal joins where necessary, and some other applications that you will not find in a typical SQL DEV tool.

The application successfully creates an SQL query. The problem is that I also allow users to directly enter their own SQL. I am worried about potential issues like SQL injection.

I am not sure if this is the right place; but in addition to the question - if anyone could recommend a good Oracle book that would make me deal with such things - I would really admit it to her.

Answer 1

One solution is GRANTonly your user privilege SELECT, if only the user is allowed.

See " Oracle Database Security Guide: An Introduction to Privileges "

, , SELECT. , , SELECT.

---

: SQL- . : . , SQL-.

, , SQL, , , . SQL, , .

. SQL-."

Answer 2

Oracle , . , , ///, .

, SELECT . "SELECT * FROM table FOR UPDATE of column" . SELECT... FOR UPDATE SELECT.

(, ) ( , , , IO CPU).

SQL- SQL ?

Answer 3

, "select" "with". PL/SQL Ada, / , SQL- .

, , , , , . , begin/end SQL-.

Answer 4

, , , , SQL- - , .

, , , . SQL plan_table, , , , /, , where , , - "" , ..

Answer 5

Oracle pl/sql. DBMS_ASSERT SQL .

Even with these tests, I would be very reluctant to provide people with an open text window for creating their queries, especially in a public network or in a large organization where you do not know everyone. There are very creative people who are just looking for such opportunities.