Top Banner
COM: Databases Introduction SQL SQLite Code Dynamic queries SQL injection Recap Further reading COM: Databases Coventry University
47

SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

May 03, 2020

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

122COM: Databases

Coventry University

mailto:[email protected]
Page 2: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

Overview1 IntroductionSQLSQLite2 CodeDynamic queriesSQL injection

3 Recap4 Further reading

Page 3: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

Expectations CYou have all attempted the green Codio exercises for this week.

0 10 20 30 40 50 60 70 80 90 100 110 120020406080100

Mean weekly time spent on Codio pre-tasks (mins)

Mark%

122COM results 2016-17 September starters.

Phase test 1Phase test 2

Page 4: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

SQL C

Database (noun) - a collection of information that is organized so that itcan easily be accessed, managed, and updated.

Pronounced S-Q-L or Sequel.Structured Query Language.

Used to query relational databases.Theoretically it doesn’t matter what underlying database is.

MS SQL Server, Oracle, PostgreSQL, MySQL, SQLite.In reality lots of minor variations.

Page 5: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

SQL C

Database (noun) - a collection of information that is organized so that itcan easily be accessed, managed, and updated.Pronounced S-Q-L or Sequel.

Structured Query Language.Used to query relational databases.Theoretically it doesn’t matter what underlying database is.

MS SQL Server, Oracle, PostgreSQL, MySQL, SQLite.In reality lots of minor variations.

Page 6: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

Relational Databases C

Built around tables.Can be imagined like a spreadsheet.

id forename surname job0 Malcolm Reynolds CaptainRow/record → 4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye Mechanic↑Column/attribute

Page 7: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

C

Many types of query.SELECT - Get information from the database.INSERT - Add information to the database.DELETE - Remove information.

Also used for database administration.CREATE - Create a whole new table/schema/function.ALTER - Modify a table/schema/function.DROP - Delete a whole table/schema/function.

Page 8: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

SELECT CUsed to retrieve information from the database.

id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye MechanicSELECT * FROM staff;

*means everything.# id forename surname job1 0 Malcolm Reynolds Captain2 4 Zoe Washburne Co-captain3 11 Hoban Washburne Pilot4 23 Kaywinnet Frye Mechanic

Page 9: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

SELECT CUsed to retrieve information from the database.

id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye Mechanic

SELECT * FROM staff;

*means everything.# id forename surname job1 0 Malcolm Reynolds Captain2 4 Zoe Washburne Co-captain3 11 Hoban Washburne Pilot4 23 Kaywinnet Frye Mechanic

Page 10: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

SELECT CUsed to retrieve information from the database.

id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye MechanicSELECT * FROM staff;

*means everything.

# id forename surname job1 0 Malcolm Reynolds Captain2 4 Zoe Washburne Co-captain3 11 Hoban Washburne Pilot4 23 Kaywinnet Frye Mechanic

Page 11: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

SELECT CUsed to retrieve information from the database.

id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye MechanicSELECT * FROM staff;

*means everything.# id forename surname job1 0 Malcolm Reynolds Captain2 4 Zoe Washburne Co-captain3 11 Hoban Washburne Pilot4 23 Kaywinnet Frye Mechanic

Page 12: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

SELECT C

Used to retrieve information from the database.

id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye MechanicSELECT * FROM staff WHERE surname = "Washburne";

Only return the records WHERE something is true.# id forename surname job1 4 Zoe Washburne Co-captain2 11 Hoban Washburne Pilot

Page 13: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

SELECT C

Used to retrieve information from the database.id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye Mechanic

SELECT * FROM staff WHERE surname = "Washburne";

Only return the records WHERE something is true.# id forename surname job1 4 Zoe Washburne Co-captain2 11 Hoban Washburne Pilot

Page 14: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

SELECT C

Used to retrieve information from the database.id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye Mechanic

SELECT * FROM staff WHERE surname = "Washburne";

Only return the records WHERE something is true.

# id forename surname job1 4 Zoe Washburne Co-captain2 11 Hoban Washburne Pilot

Page 15: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

SELECT C

Used to retrieve information from the database.id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye Mechanic

SELECT * FROM staff WHERE surname = "Washburne";

Only return the records WHERE something is true.# id forename surname job1 4 Zoe Washburne Co-captain2 11 Hoban Washburne Pilot

Page 16: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

count() I

What if we want to now how many records there are?count() function.More efficient.

Minimum amount of data.

id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye MechanicSELECT count(*) FROM staff;

# count(*)1 4

Page 17: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

count() I

What if we want to now how many records there are?count() function.More efficient.

Minimum amount of data.id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye Mechanic

SELECT count(*) FROM staff;

# count(*)1 4

Page 18: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

count() I

What if we want to now how many records there are?count() function.More efficient.

Minimum amount of data.id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye Mechanic

SELECT count(*) FROM staff;

# count(*)1 4

Page 19: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

count() I

What if we want to now how many records there are?count() function.More efficient.

Minimum amount of data.id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye Mechanic

SELECT count(*) FROM staff;

# count(*)1 4

Page 20: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

INSERT I

Used to add information to the database.

id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye MechanicINSERT INTO staff VALUES (42, 'Simon', 'Tam', 'Doctor');

id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye Mechanic42 Simon Tam Doctor

Page 21: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

INSERT I

Used to add information to the database.id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye Mechanic

INSERT INTO staff VALUES (42, 'Simon', 'Tam', 'Doctor');

id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye Mechanic42 Simon Tam Doctor

Page 22: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

INSERT I

Used to add information to the database.id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye Mechanic

INSERT INTO staff VALUES (42, 'Simon', 'Tam', 'Doctor');

id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye Mechanic42 Simon Tam Doctor

Page 23: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

INSERT I

Used to add information to the database.id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye Mechanic

INSERT INTO staff VALUES (42, 'Simon', 'Tam', 'Doctor');

id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye Mechanic42 Simon Tam Doctor

Page 24: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

INSERT again I

Don’t have to supply values for all the columns.Depends on the table design.

INSERT INTO staff (forename, id, surname)VALUES ('River', 43, 'Tam');

id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye Mechanic42 Simon Tam Doctor43 River Tam

Page 25: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

INSERT again I

Don’t have to supply values for all the columns.Depends on the table design.

INSERT INTO staff (forename, id, surname)VALUES ('River', 43, 'Tam');

id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye Mechanic42 Simon Tam Doctor43 River Tam

Page 26: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

INSERT again I

Don’t have to supply values for all the columns.Depends on the table design.

INSERT INTO staff (forename, id, surname)VALUES ('River', 43, 'Tam');

id forename surname job0 Malcolm Reynolds Captain4 Zoe Washburne Co-captain11 Hoban Washburne Pilot23 Kaywinnet Frye Mechanic42 Simon Tam Doctor43 River Tam

Page 27: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

Databases C

Why use databases at all?Why not just use dictionaries and lists or similar?Databases...

Have structure.Easy to organise the data.

Scale.Can handle a LOT of data.

Multi-user.Can have lots of people working on the same data.

Fault tolerant.Can recover if things go wrong.

Page 28: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

SQLite I

Using SQLite3 in labs.Not a fully featured database.

But has all the basic features.SQL.

Good for small/non-urgent databases.≤ gigabytes of data.

EfficientDon’t need to waste resources on a ’real’ database.

Convenient.Don’t need to install, configure, manage a ’real’ database.Portable, 1 file.

No network.Single user only.

Page 29: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

Python C

How to use SQL queries in Python?import sqlite3 as sql # sqlite module

con = sql.connect( 'firefly.sqlite' ) # open databasecur = con.cursor()

cur.execute( '''SELECT * FROM staff;''' ) # run queryfor row in cur: # loop over results

print( row )

con.close() # close databaselec_select.py

(0, 'Malcolm ', 'Reynolds ', 'Captain ')(4, 'Zoe ', 'Washburne ', 'Co -captain ')(11, 'Hoban ', 'Washburne ', 'Pilot ')(23, 'Kaywinnet ', 'Frye ', 'Mechanic ')

Page 30: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

Python C

How to use SQL queries in Python?import sqlite3 as sql # sqlite module

con = sql.connect( 'firefly.sqlite' ) # open databasecur = con.cursor()

cur.execute( '''SELECT * FROM staff;''' ) # run queryfor row in cur: # loop over results

print( row )

con.close() # close databaselec_select.py

(0, 'Malcolm ', 'Reynolds ', 'Captain ')(4, 'Zoe ', 'Washburne ', 'Co -captain ')(11, 'Hoban ', 'Washburne ', 'Pilot ')(23, 'Kaywinnet ', 'Frye ', 'Mechanic ')

Page 31: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

C++ IHow to use SQL queries in C++?#include "libsqlite.hpp" // sqlite library

int main(){

sqlite::sqlite db( "firefly.sqlite" ); // open database

auto cur = db.get_statement(); // create querycur->set_sql( "SELECT * FROM staff;" );cur->prepare(); // run query

while( cur->step() ) // loop over resultscout « cur->get_int(0) « " " « cur->get_text(1) « endl;

}lec_select.cpp

0 Malcolm4 Zoe11 Hoban23 Kaywinnet

Page 32: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading Break

Page 33: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

Static queries I

So far looked at static queries.Same query is run every time.Real power is in dynamic queries.

Code creates changes the SQL to ask new questions.

Page 34: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

Dynamic queries I

import sqlite3 as sql

con = sql.connect('firefly.sqlite')cur = con.cursor()

question = input('Who is the...')

cur.execute('''SELECT forename, surname FROM staffWHERE job = ?;''', (question,))

for row in cur:print('%s %s' % row)

lec_dynamic.py

Who is the ... CaptainMalcolm Reynolds

Page 35: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

Dynamic queries C++ I

Using sqlitepp.3rd party wrapperaround defaultSQLite3 API.Simplified use.

sqlite::sqlite db( "firefly.sqlite" );

string question;cout « "Who is the...";cin » question;

auto s = db.get_statement();s->set_sql( "SELECT forename, surname FROM staff "

"WHERE job = ?;" );s->prepare();s->bind( 1, question );

while( s->step() ){

string forename = s->get_text(0);string surname = s->get_text(1);cout « forename « " " « surname « endl;

}lec_dynamic.cpp

Page 36: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

Bad dynamic queries IDynamic queries should ALWAYS use placeholders (i.e. ?).cur.execute('''SELECT forename, surname FROM staff

WHERE job = ?;''', (question,))

Dynamic queries must NEVER be created by manipulating strings.cur.execute('''SELECT forename, surname FROM staff

WHERE job = "%s";''' % question )cur.execute('''SELECT forename, surname FROM staff

WHERE job = "{}";'''.format( question) )

User could input anything, e.g. SQL commands!.Captain"; DROP TABLE staff; –

Sanitise your inputs.

Always use placeholders.No exceptions.NO EXCEPTIONS!

Page 37: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

Bad dynamic queries IDynamic queries should ALWAYS use placeholders (i.e. ?).cur.execute('''SELECT forename, surname FROM staff

WHERE job = ?;''', (question,))

Dynamic queries must NEVER be created by manipulating strings.cur.execute('''SELECT forename, surname FROM staff

WHERE job = "%s";''' % question )cur.execute('''SELECT forename, surname FROM staff

WHERE job = "{}";'''.format( question) )

User could input anything, e.g. SQL commands!.Captain"; DROP TABLE staff; –

Sanitise your inputs.Always use placeholders.

No exceptions.NO EXCEPTIONS!

Page 38: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

Bad dynamic queries IDynamic queries should ALWAYS use placeholders (i.e. ?).cur.execute('''SELECT forename, surname FROM staff

WHERE job = ?;''', (question,))

Dynamic queries must NEVER be created by manipulating strings.cur.execute('''SELECT forename, surname FROM staff

WHERE job = "%s";''' % question )cur.execute('''SELECT forename, surname FROM staff

WHERE job = "{}";'''.format( question) )

User could input anything, e.g. SQL commands!.Captain"; DROP TABLE staff; –

Sanitise your inputs.Always use placeholders.No exceptions.

NO EXCEPTIONS!

Page 39: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

Bad dynamic queries IDynamic queries should ALWAYS use placeholders (i.e. ?).cur.execute('''SELECT forename, surname FROM staff

WHERE job = ?;''', (question,))

Dynamic queries must NEVER be created by manipulating strings.cur.execute('''SELECT forename, surname FROM staff

WHERE job = "%s";''' % question )cur.execute('''SELECT forename, surname FROM staff

WHERE job = "{}";'''.format( question) )

User could input anything, e.g. SQL commands!.Captain"; DROP TABLE staff; –

Sanitise your inputs.Always use placeholders.No exceptions.NO EXCEPTIONS!

Page 40: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

Bad dynamic queries IDynamic queries should ALWAYS use placeholders (i.e. ?).cur.execute('''SELECT forename, surname FROM staff

WHERE job = ?;''', (question,))

Dynamic queries must NEVER be created by manipulating strings.cur.execute('''SELECT forename, surname FROM staff

WHERE job = "%s";''' % question )cur.execute('''SELECT forename, surname FROM staff

WHERE job = "{}";'''.format( question) )

User could input anything, e.g. SQL commands!.Captain"; DROP TABLE staff; –

Sanitise your inputs.Always use placeholders.No exceptions.NO EXCEPTIONS!

Page 41: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

SQL injection AAround since at least 1998.Notable SQL injection attacks.

2017 Equifax - 143,000,000 USconsumers potentially impacted.Or to put it another way, half ofAmerica.

2015 TalkTalk - 160,000 customers’details.2014 Hold security - found 420,000vulnerable websites.2011MySql - mysql.comcompromised.2008 Heartland Payment -134,000,000 credit cards.

Many, many more. https://xkcd.com/327/

https://xkcd.com/327/
Page 42: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

SQL injection C

Injection attacks are STILL No. 1 on Open Web Application Security Project(OWASP) Top 10 list.How is this still a thing?Do NOT write code that is vulnerable to this.

Do NOT write code that execute user input directly.Just use placeholders! Problem solved.

SQL injection is a critical bug and IWILLmark down code that isvulnerable.

Page 43: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

Recap

SQL used to query databases.Databases are...

fault tolerant.multi user.scalable.Always use place holders in dynamic queries.

Say no to SQL injection!

Page 44: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

Why do I care?Everyone

Structured Query Language (SQL) is widely used, most in demandlanguage1.Should be aware of and able to defend against SQL injection.Experience in using 3rd party libraries/modules in software.

Computing - SQL is a vital for much of the web. Heard of LAMPservers?, the M is for MySQL.Ethical Hackers - need to understand SQL injection.ITB - SQL is widely used in business applications, especially forgenerating reports.Games Tech & MC- SQL is used in games, i.e. for save games.

1According to Indeed.com

Page 45: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

Further reading A

Introduction to SQL - http://www.w3schools.com/sql/sql_intro.aspSQL injection hall of shame -http://codecurmudgeon.com/wp/sql-injection-hall-of-shame/Efficient inserting - the executemany()method.

http://www.w3schools.com/sql/sql_intro.asp
http://codecurmudgeon.com/wp/sql-injection-hall-of-shame/
Page 46: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading

Expectations C

Complete the yellow Codio exercises for this week.Revise for Phase Test 1. Worth 20% of your 122COMmarks.If you have spare time attempt the red Codio exercises.If you are having issues come to the PSC.https://gitlab.com/coventry-university/programming-support-lab/wikis/home

https://gitlab.com/coventry-university/programming-support-lab/wikis/home
https://gitlab.com/coventry-university/programming-support-lab/wikis/home
Page 47: SQLite Code †‡‡COM: Databases · †‡‡COM: Databases Introduction SQL SQLite Code Dynamicqueries SQLinjection Recap Further reading Overview † Introduction SQL SQLite

122COM:Databases

IntroductionSQLSQLiteCodeDynamic queriesSQL injectionRecapFurtherreading The End


Related Documents
SQLite Recoveryforensicinsight.org/.../2013/07/INSIGHT-SQLite-Recovery.pdf · 2014. 8. 6. · SQLite 파일의복구 • 데이터추출을효과적으로하는방법 텍스트형식으로저장되어있으므로,

SQLite...

Category: Documents
Databases in Python - polito.it · Databases in Python MySQL, SQLite Accessing persistent storage (Relational databases) from Python code. Goal •Making some data 'persistent' –When

Databases in Python - polito.it · Databases in Python...

Category: Documents
Databases and SQLite · † sqlite3 has been part of the Python library since 2.5 † sqlite3 provides connection and cursor objects to manage databases 26. Melbourne Linux Users

Databases and SQLite · † sqlite3 has been part of the...

Category: Documents
GEB—SQLite in Tcl in SQLite

GEB—SQLite in Tcl in SQLite

Category: Documents
SQLite et Androidsalihayacoub.com/420Ke9/SQLite/SqliteExemple.pdf1 Denis Brunet, Saliha Yacoub SQLite et Android SQLite SQLite est un moteur de bases de données libre qui implémente

SQLite et...

Category: Documents
Relational Databases and SQLite - dr-chuck.net · PDF fileRelational Databases and SQLite ... A database administrator ... column that contains a key which points to the primary key

Relational Databases and SQLite - dr-chuck.net · PDF...

Category: Documents
Hack x Crack SQLinjection

Hack x Crack SQLinjection

Category: Documents
Sqlite, Introductionsalihayacoub.com/420Ke9/SQLite/SqliteIntroduction.pdf · 2019-11-11 · SQLite, Introduction •Définition SQLite est un moteur de bases de données libre qui

Sqlite,...

Category: Documents
Databases in Python - polito.it · Databases in Python MySql, SQLite ... Database API definition: PEP 0249 MySQL «connector» module SQLite module MySQL server SQLite library . Analyzed

Databases in Python - polito.it · Databases in Python...

Category: Documents
SQLite - Overview

SQLite - Overview

Category: Technology
SQLite Example

SQLite Example

Category: Technology
Data and System Interoperability with ArcGIS · Common Database Connections Supported in ArcGIS User Managed Databases with direct connections • SQL Server • PostgreSQL • SQLite

Data and System Interoperability with ArcGIS · Common...

Category: Documents