Category Archives: database

SQL Commands:

SQL commands are instructions used to communicate with the database to perform specific task that work with data. SQL commands can be used not only for searching the database but also to perform various other functions like, for example, you can create tables, add data to tables, or modify data, drop the table, set permissions for users. SQL commands are grouped into four major categories depending on their functionality:

  • Data Definition Language (DDL) – These SQL commands are used for creating, modifying, and dropping the structure of database objects. The commands are CREATE, ALTER, DROP, RENAME, and TRUNCATE.
  • Data Manipulation Language (DML) – These SQL commands are used for storing, retrieving, modifying, and deleting data. These commands are SELECT, INSERT, UPDATE, and DELETE.
  • Transaction Control Language (TCL) – These SQL commands are used for managing changes affecting the data. These commands are COMMIT, ROLLBACK, and SAVEPOINT.
  • Data Control Language (DCL) – These SQL commands are used for providing security to database objects. These commands are GRANT and REVOKE.
Advertisements

String to Date Conversion in SQL with (STR_TO_DATE)

STR_TO_DATE(str,format) is the inverse of the DATE_FORMAT() function.
STR_TO_DATE() returns a DATETIME value.

Ex:
mysql> SELECT STR_TO_DATE('04/31/2004', '%m/%d/%Y');
——————————————————————————————–
| STR_TO_DATE('04/31/2004', '%m/%d/%Y') |
------------------------------------------------------------------
2004-04-31          
The following specifiers may be used in the format string.
The '%' character is required before format specifier characters.         
       
Specifier Description
%a Abbreviated weekday name (Sun..Sat)
%b Abbreviated month name (Jan..Dec)
%c Month, numeric (0..12)
%D Day of the month with English suffix (0th, 1st, 2nd, 3rd, ?-)
%d Day of the month, numeric (00..31)
%e Day of the month, numeric (0..31)
%f Microseconds (000000..999999)
%H Hour (00..23)
%h Hour (01..12)
%I Hour (01..12)
%i Minutes, numeric (00..59)
%j Day of year (001..366)
%k Hour (0..23)
%l Hour (1..12)
%M Month name (January..December)
%m Month, numeric (00..12)
%p AM or PM
%r Time, 12-hour (hh:mm:ss followed by AM or PM)
%S Seconds (00..59)
%s Seconds (00..59)
%T Time, 24-hour (hh:mm:ss)
%U Week (00..53), where Sunday is the first day of the week
%u Week (00..53), where Monday is the first day of the week
%V Week (01..53), where Sunday is the first day of the week; used with %X
%v Week (01..53), where Monday is the first day of the week; used with %x
%W Weekday name (Sunday..Saturday)
%w Day of the week (0=Sunday..6=Saturday)
%X Year for the week where Sunday is the first day of the week, numeric, four digits; used with %V
%x Year for the week, where Monday is the first day of the week, numeric, four digits; used with %v
%Y Year, numeric, four digits
%y Year, numeric (two digits)
%% A literal ‘%’ character
%x x, for any ‘x’ not listed above

one column in onetable is insert into another table in mysql query

one column in onetable is insert into another table in mysql query
 
update Fileversions
set Fileversions.filename = (select Filedata.filename
from Filedata
where Fileversions.file_id=Filedata.file_id)
where exists (select 1
from Filedata
where Fileversions.file_id=Filedata.file_id) 
 

Update multiple rows with multiple values and multiple conditions mysql


Update multiple rows with multiple values and multiple conditions mysql


I am facing a complex situation of SQL queries. The task is to update multiple rows, with multiple values and multiple conditions. Following is the data which I want to update; Field to update: ‘sales’, condition fields: ‘campid’ and ‘date’:
if campid = 259 and date = 22/6/2011 then set sales = $200
else if campid = 259 and date = 21/6/2011 then set sales = $210
else if campid = 260 and date = 22/6/2011 then set sales = $140
else if campid = 260 and date = 21/6/2011 then set sales = $150

Solution:

UPDATE your_table SET sales = CASE 
   
WHEN campid = 259 AND date = 22/6/2011 THEN 200
   
WHEN campid = 259 AND date = 21/6/2011 THEN 210
   
WHEN campid = 259 AND date = 22/6/2011 THEN 140
   
WHEN campid = 259 AND date = 21/6/2011 THEN 150
   
ELSE salesEND

Copy data of One Database Table to Another database table


Copy data of One Database Table to Another database table


INSERT INTO destinationdatabase.destinationtablename SELECT * FROM sourcedatabase.sourcetablename

Read from JSON file and persist into MySQL

Here is a simple example where we are reading contents of a JSON file and inserting into MySQL database. The code is dynamic so it can handle any number of columns no matter what the column name is. All you have to do is match the database column names with JSON content.

For this demo, we are using following jar files.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
import java.io.InputStream;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.SQLException;
import java.util.Iterator;
import net.sf.json.JSONArray;
import net.sf.json.JSONObject;
import net.sf.json.JSONSerializer;
import org.apache.commons.io.IOUtils;
public class MyJson {
 private static String tableName = "jsontest";
 public static void main(String[] args) {
  try {
   ClassLoader cl = MyJson.class.getClassLoader();
   InputStream is = cl.getResourceAsStream("test.json");
   String str = IOUtils.toString(is);
   JSONObject jsonObject = (JSONObject) JSONSerializer.toJSON(str);
   JSONArray jsonArr = jsonObject.getJSONArray("profiles");
   JSONObject obj = null;
   JSONArray nameArr = null;
   JSONArray valArr = null;
   
   for (int i = 0; i < jsonArr.size(); i++) {
    obj = jsonArr.getJSONObject(i);
    nameArr = obj.names();
    valArr = obj.toJSONArray(nameArr);
    saveRecord(nameArr, valArr);
   }
  } catch (Exception e) {
   e.printStackTrace();
  }
 }
 private static void saveRecord(JSONArray nameArray, JSONArray valArray) {
  Connection conn = getConnection();
  StringBuffer sb = new StringBuffer("insert into " + tableName + "(");
  int size = nameArray.size();
  int count = 0;
  Iterator<Object> iterator = nameArray.iterator();
  
  while (iterator.hasNext()) {
   if (count < (size - 1))
    sb.append(iterator.next() + ",");
   else
    sb.append(iterator.next() + ")");
   count++;
  }
  sb.append(" values(");
 
  for (int i = 0; i < size; i++) {  
   if (i < (size - 1))
    sb.append("?,");
   else
    sb.append("?)");  
  }
  System.out.println(sb.toString());
  try {
   PreparedStatement pstmt = conn.prepareStatement(sb.toString());
   bindVariables(valArray, pstmt);
   pstmt.executeUpdate();
  } catch (SQLException e) {
   e.printStackTrace();
  }
 }
 private static void bindVariables(JSONArray valArray,
   PreparedStatement pstmt) throws SQLException {
  Iterator<Object> iterator = valArray.iterator();
  int cnt = 0;
  while (iterator.hasNext()) {
   Object obj = iterator.next();
   if (obj instanceof String) {
    pstmt.setString(++cnt, (String) obj);
   } else if (obj instanceof Integer) {
    pstmt.setLong(++cnt, (Integer) obj);
   } else if (obj instanceof Long) {
    pstmt.setLong(++cnt, (Long) obj);
   } else if (obj instanceof Double) {
    pstmt.setDouble(++cnt, (Double) obj);
   }
  }
 }
 private static Connection getConnection() {
  Connection con = null;
  String url = "jdbc:mysql://localhost:3306/";
  String db =  "user";
  String driver = "com.mysql.jdbc.Driver";
  String user = "root";
  String pass = "hello";
  try {
   Class.forName(driver);
   con = DriverManager.getConnection(url + db, user, pass);
  } catch (ClassNotFoundException e) {
   e.printStackTrace();
  } catch (SQLException e) {
   e.printStackTrace();
  }
  return con;
 }
}

And this the content of json file(test.json) we have.

1
2
3
4
5
6
7
{'profiles': [
  {'name':'John', 'age': 44, 'phone':'203-203-2030'},
  {'name':'Alex','age':31, 'phone':'203-203-2030'},
  {'name':'Amy', 'age': 24, 'phone':'203-203-2030'},
  {'name':'Melissa','age':21, 'phone':'203-203-2030'}
 ]
}
 

SQL Injection

The platform affected can be:

  • Language: SQL
  • Platform: Any (requires interaction with a SQL database)

SQL Injection has become a common issue with database-driven web sites. The flaw is easily detected, and easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted attack of this kind.

Essentially, the attack is accomplished by placing a meta character into data input to then place SQL commands in the control plane, which did not exist there before. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.

Examples

Example 1

In SQL:

select id, firstname, lastname from authors

If one provided:

Firstname: evil'ex
Lastname: Newman

the query string becomes:

select id, firstname, lastname from authors where forename = 'evil'ex' and surname ='newman'
which the database attempts to run as 

Incorrect syntax near il' as the database tried to execute evil.

A safe version of the above SQL statement could be coded in Java as:

String firstname = req.getParameter("firstname");
String lastname = req.getParameter("lastname");
// FIXME: do your own validation to detect attacks
String query = "SELECT id, firstname, lastname FROM authors WHERE forename = ? and surname = ?";
PreparedStatement pstmt = connection.prepareStatement( query );
pstmt.setString( 1, firstname );
pstmt.setString( 2, lastname );
try
{
	ResultSet results = pstmt.execute( );
}

Example 2

The following C# code dynamically constructs and executes a SQL query that searches for items matching a specified name. The query restricts the items displayed to those where owner matches the user name of the currently-authenticated user.

	...
	string userName = ctx.getAuthenticatedUserName();
	string query = "SELECT * FROM items WHERE owner = "'" 
					+ userName + "' AND itemname = '"  
					+ ItemName.Text + "'";
	sda = new SqlDataAdapter(query, conn);
	DataTable dt = new DataTable();
	sda.Fill(dt);
	...

The query that this code intends to execute follows:

	SELECT * FROM items
	WHERE owner = 
	AND itemname = ;

However, because the query is constructed dynamically by concatenating a constant base query string and a user input string, the query only behaves correctly if itemName does not contain a single-quote character. If an attacker with the user name wiley enters the string “name’ OR ‘a’=’a” for itemName, then the query becomes the following:

	SELECT * FROM items
	WHERE owner = 'wiley'
	AND itemname = 'name' OR 'a'='a';

The addition of the OR ‘a’=’a’ condition causes the where clause to always evaluate to true, so the query becomes logically equivalent to the much simpler query:

	SELECT * FROM items;

This simplification of the query allows the attacker to bypass the requirement that the query only return items owned by the authenticated user; the query now returns all entries stored in the items table, regardless of their specified owner.

Example 3

This example examines the effects of a different malicious value passed to the query constructed and executed in Example 1. If an attacker with the user name hacker enters the string “hacker’); DELETE FROM items; –” for itemName, then the query becomes the following two queries:

	SELECT * FROM items 
	WHERE owner = 'hacker'
	AND itemname = 'name';

	DELETE FROM items;

	--'

Many database servers, including Microsoft® SQL Server 2000, allow multiple SQL statements separated by semicolons to be executed at once. While this attack string results in an error in Oracle and other database servers that do not allow the batch-execution of statements separated by semicolons, in databases that do allow batch execution, this type of attack allows the attacker to execute arbitrary commands against the database.

Notice the trailing pair of hyphens (–), which specifies to most database servers that the remainder of the statement is to be treated as a comment and not executed. In this case the comment character serves to remove the trailing single-quote left over from the modified query. In a database where comments are not allowed to be used in this way, the general attack could still be made effective using a trick similar to the one shown in Example 1. If an attacker enters the string “name’); DELETE FROM items; SELECT * FROM items WHERE ‘a’=’a”, the following three valid statements will be created:

	SELECT * FROM items 
	WHERE owner = 'hacker'
	AND itemname = 'name';

	DELETE FROM items;

	SELECT * FROM items WHERE 'a'='a';

One traditional approach to preventing SQL injection attacks is to handle them as an input validation problem and either accept only characters from a whitelist of safe values or identify and escape a blacklist of potentially malicious values. Whitelisting can be a very effective means of enforcing strict input validation rules, but parameterized SQL statements require less maintenance and can offer more guarantees with respect to security. As is almost always the case, blacklisting is riddled with loopholes that make it ineffective at preventing SQL injection attacks. For example, attackers can:

  • Target fields that are not quoted
  • Find ways to bypass the need for certain escaped meta-characters
  • Use stored procedures to hide the injected meta-characters

Manually escaping characters in input to SQL queries can help, but it will not make your application secure from SQL injection attacks.

Another solution commonly proposed for dealing with SQL injection attacks is to use stored procedures. Although stored procedures prevent some types of SQL injection attacks, they fail to protect against many others. For example, the following PL/SQL procedure is vulnerable to the same SQL injection attack shown in the first example.

	procedure get_item (
		itm_cv IN OUT ItmCurTyp,
		usr in varchar2,
		itm in varchar2)
	is
		open itm_cv for ' SELECT * FROM items WHERE ' ||
				'owner = '''|| usr || 
				' AND itemname = ''' || itm || '''';
	end get_item;

Stored procedures typically help prevent SQL injection attacks by limiting the types of statements that can be passed to their parameters. However, there are many ways around the limitations and many interesting statements that can still be passed to stored procedures. Again, stored procedures can prevent some exploits, but they will not make your application secure against SQL injection attacks.

%d bloggers like this: