Injection safe call to IAxaptaRecord.ExecuteStmt()

Question

Is there an injection safe way to call via the axpata business connector

string salesId = someObject.Text;

IAxaptaRecord salesLine = ax.CreateRecord("SalesLine");
salesLine.ExecuteStmt("select * from %1 where %1.SalesId == '" + salesId + "'");

If someObject.Text is set to the following, i am then vulnerable to x++ code injection:

"SomeSalesOrder' || %1.SalesId == 'SomeOtherOrder"

Is there a way to parametrize the query, or would it be better to write all of the data access code directly in x++, and then call that from COM?

Answer 1

you should do a replace on ' to \' e.g.

string salesId = someObject.Text.Replace("'", "\\'");

Answer 2

There is no way to be sure you have covered all cases ...

Using ExecuteStmt is most likely the wrong approach. You should write your select or whatever in an Axapta method (with parameters) then call that method.

Answer 3

Holz,

You can use parametrized SELECT statements with the forcePlaceholder keyword. This is the default behavior in X++, but since this behavior can be overriden for complex joins, it's good idea to implicitly specify the forcePlaceholder hint.

As parametrized SELECTs impose some additional overhead, and don't allow optimiziation on the actual values of the parameters, you may want to consider using views, or axapta queries instead.

Regards, Velislav Marinov