Re: Security Question - how do you deal with sensitive information hardcoded in SQL statements
- From: Wolfgang Breitling <breitliw@xxxxxxxxxxxxx>
- To: kennethnaim@xxxxxxxxx
- Date: Mon, 2 May 2011 22:57:16 -0600
It can't depend on the client as cursor_sharing is a database parameter. I have
not seen what you describe except if cursor_sharing was turned on dynamically
and the sql hadn't aged out of the shared pool since they were using bind
variables and were still reused.
On 2011-05-02, at 3:15 PM, Kenneth Naim wrote:
> I've dealt with many applications that use bind variable improperly mostly
> on 10g and have seen this frequently. I haven't tested it on other versions
> and it possible that it depends on the client doing the binding.
>
--
//www.freelists.org/webpage/oracle-l
Other related posts:
