There's a lot of comments regarding which type of SQL to use (Dynamic SQL vs Embedded SQL). I believe both are useful in their own right but when using Dynamic SQL, proper care needs to be taken that user input, if added to the SQL statement, is correctly handled.
This is very important because if not handled correctly, it could lead to SQL injection attacks.
A good article explaining this is written and posted by @Ash Sherzhanov here: https://community.intersystems.com/post/avoiding-sql-injection-intersystems-iris-case-secure-query-practices
Some best practices for Dynamic SQL are in this article by @Timothy Leavitt: https://community.intersystems.com/post/dynamic-sql-best-practices-or-how-avoid-both-sql-injection-vulnerabilities-and-spaghetti-code
There are some good discussions in the comments of the article by Tim as well.
- Log in to post comments