Need some SQL help

[MrMark]

If your web users are only doing selects on the database, it may be useful practice to make sure their privileges on the database involved are limited to just selects (ie stop them being able to insert update or delete). A belt and braces approach, as you will already be trying to prevent sql injection at application level as mentioned above. The biggest danger is allowing the hacker to gain userid knowledge from the users table at login.

[Cliphead]

Taken onboard. Learning a lot about this and quite happy that things are as secure as they can be at the moment. I don't know much about SQL but I know UNIX and security so that's a good start.

I've also quizzed the developers about their methods and asked for their input re security bit not expecting much feedback...

[BrilloPad]

Google for SQL injection if you're planning on implementing a web-based interface to a database-backed application.

Also worth looking up cross-site scripting, and cross-site request forgery

http://www.cgisecurity.com/2007/06/27

Even microsoft have suffered! They should have employed NF...

[NickFitz]

Excellent!

Google for SQL injection if you're planning on implementing a web-based interface to a database-backed application.

Also worth looking up cross-site scripting, and cross-site request forgery

[BrilloPad]

Excellent!

I sent this to the dbas at clientco - they did not so much as laugh. either they have seen it several times before or are humourless ****s

[Cliphead]

Have you allowed for this?

http://benajnim.com/index.php/php/sa...-input-in-php/

Excellent!

[BrilloPad]

Have you allowed for this?

http://benajnim.com/index.php/php/sa...-input-in-php/

[Cliphead]

try "drop table user"

HTH

I already did that, the backup script worked

[BrilloPad]

I'd be forever grateful and would love to buy a pint or two for anyone who can help me out with this. I know zip about SQL.

I have a web app using Postgres as the backend. I've installed phpPgAdmin on the web server so I can look but not touch anything in there.

I want to do a simple listing of all the users but I need to query two tables, one holds the username, first and last names, the other holds email and home address etc.

I know this is likely very simple to do but I haven't got a clue

try "drop table user"

HTH

[Cliphead]

HTH

I sorta knew how the query should be structured but not the actual syntax. This stuff is a long way from Clipper

Thanks again!

[NickFitz]

Yes, the first example was bang on and got it working for me.

You're a star Nick, I owe you for this one!

HTH

[Cliphead]

Presumably the username is used as a key in the table that holds the details? Or is there a numeric field, probably called "id", and a corresponding numeric field, probably called "user_id", in the second field?

As those questions might suggest you really need to explicitly state what the structure of the tables is (and indeed their names), but this might get you started:

SELECT user.username, user.first_name, user.last_name, user_info.email
FROM user, user_info
WHERE user.id = user_info.user_id

or, if the username is used as the key,

SELECT user.username, user.first_name, user.last_name, user_info.email
FROM user, user_info
WHERE user.username = user_info.username

Yes, the first example was bang on and got it working for me.

You're a star Nick, I owe you for this one!

[NickFitz]

I'd be forever grateful and would love to buy a pint or two for anyone who can help me out with this. I know zip about SQL.

I have a web app using Postgres as the backend. I've installed phpPgAdmin on the web server so I can look but not touch anything in there.

I want to do a simple listing of all the users but I need to query two tables, one holds the username, first and last names, the other holds email and home address etc.

I know this is likely very simple to do but I haven't got a clue

Presumably the username is used as a key in the table that holds the details? Or is there a numeric field, probably called "id", and a corresponding numeric field, probably called "user_id", in the second field?

As those questions might suggest you really need to explicitly state what the structure of the tables is (and indeed their names), but this might get you started:

SELECT user.username, user.first_name, user.last_name, user_info.email
FROM user, user_info
WHERE user.id = user_info.user_id

or, if the username is used as the key,

SELECT user.username, user.first_name, user.last_name, user_info.email
FROM user, user_info
WHERE user.username = user_info.username

[Cliphead]

I'd be forever grateful and would love to buy a pint or two for anyone who can help me out with this. I know zip about SQL.

I have a web app using Postgres as the backend. I've installed phpPgAdmin on the web server so I can look but not touch anything in there.

I want to do a simple listing of all the users but I need to query two tables, one holds the username, first and last names, the other holds email and home address etc.

I know this is likely very simple to do but I haven't got a clue