<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>Message</TITLE>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16788" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=551504414-26012009><FONT face=Arial color=#0000ff size=2>Of
course, part of security is also having your application hit your database as a
user that only has the rights that it needs. If your user only has select
rights on only the data that you want to expose, that should help limit some of
these issues.</FONT></SPAN></DIV>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px">
<DIV></DIV>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left><FONT
face=Tahoma size=2>-----Original Message-----<BR><B>From:</B>
mapserver-users-bounces@lists.osgeo.org
[mailto:mapserver-users-bounces@lists.osgeo.org] <B>On Behalf Of
</B>umn-ms@hydrotec.de<BR><B>Sent:</B> Monday, January 26, 2009 4:43
AM<BR><B>To:</B> MapServer<BR><B>Subject:</B> Re: [mapserver-users] Dynamin
SQL with mapserver CGI?<BR><BR></FONT></DIV><BR><TT><FONT size=2>> Not any
great hazard, I believe, ...</FONT></TT> <BR><BR><FONT face=Arial size=2>Mmh.
I'd be cautious.</FONT> <BR><BR><FONT face=Arial size=2>Example:</FONT>
<BR><FONT face=Arial size=2>* Mapfile:</FONT> <BR><FONT face=Arial
size=2> DATA "the_geom from buildings"<BR></FONT><BR><FONT
face=Arial size=2>* Set Filter via URL to this:</FONT> <BR><FONT face=Arial
size=2> 1=1);DELETE FROM OTHERTABLE; DECLARE X BINARY CURSOR FOR SELECT
* from buildings WHERE (1=1</FONT> <BR><BR><FONT face=Arial size=2>I think
Mapserver will create the following statements: (I've added newlines)</FONT>
<BR><FONT face=Arial size=2>DECLARE mycursor BINARY CURSOR FOR SELECT the_geom
from buildings WHERE (1=1);</FONT> <BR><FONT face=Arial size=2>DELETE FROM
OTHERTABLE; </FONT><BR><FONT face=Arial size=2>DECLARE X BINARY CURSOR FOR
SELECT * from buildings WHERE (1=1) and (%s && setSRID( ...) )</FONT>
<BR><BR><FONT face=Arial size=2>Mapserver calls PQExec with these statements.
PQExec will execute every statement and will return </FONT><BR><FONT
face=Arial size=2>the results of the last one.</FONT> <BR><BR><FONT face=Arial
size=2>Bye</FONT> <BR><FONT face=Arial size=2>Benedikt Rothe</FONT>
<BR><BR><BR><TT><FONT size=2>"Rahkonen Jukka"
<Jukka.Rahkonen@mmmtike.fi> schrieb am 26.01.2009 09:34:31:<BR><BR>>
Hi,</FONT></TT> <BR><TT><FONT size=2>> </FONT></TT> <BR><TT><FONT
size=2>> Not any great hazard, I believe, if it means that user can
normally <BR>> get all the features, but only a subset when filter is set.
It is <BR>> different case if DATA clause is manipulated, and
therefore that <BR>> must be connected to DATAPATTERN.</FONT></TT>
<BR><TT><FONT size=2>> </FONT></TT> <BR><TT><FONT size=2>> -Jukka
Rahkonen-</FONT></TT> <BR><TT><FONT size=2>> <BR>> Lähettäjä:
mapserver-users-bounces@lists.osgeo.org [mailto:<BR>>
mapserver-users-bounces@lists.osgeo.org] Puolesta umn-ms@hydrotec.de<BR>>
Lähetetty: 26. tammikuuta 2009 10:03<BR>> Vastaanottaja: MapServer<BR>>
Aihe: Re: [mapserver-users] Dynamin SQL with mapserver
CGI?<BR></FONT></TT><BR><TT><FONT size=2>> <BR>> Hi <BR>> <BR>>
> You can use a replaceable parameter in the FILTER clause if all you ...
<BR>> This introduces the hazard of SQL-Injection, doesn't it? <BR>>
<BR>> Bye <BR>> Benedikt Rothe <BR>> <BR>>
mapserver-users-bounces@lists.osgeo.org schrieb am 24.01.2009
14:04:42:<BR>> <BR>> > On Sat, Jan 24, 2009 at 3:18 AM, Saka Royban
<srph124@yahoo.com> wrote:<BR>> > > Hi all<BR>> > >
I'm looking for a way to change SQL dynamically via URL parameters. it<BR>>
> > sounds from doc that changing DATA element in map file is
impossible. Is<BR>> > > there any other way?<BR>> > <BR>>
> You can use a replaceable parameter in the FILTER clause if all
you<BR>> > want to do is alter the WHERE clause. So for example:<BR>>
> FILTER "%criteria%"<BR>> > and<BR>> >
criteria=id='value'<BR>> > would work with a database like
Postgres.<BR>> > <BR>> > When working with a database you put the
whole SQL WHERE clause in the<BR>> > FILTER, whereas with shapefiles or
ORG data sources you use the<BR>> > FILTERITEM and FILTER.<BR>> >
<BR>> > -- <BR>> > Richard Greenwood<BR>> >
richard.greenwood@gmail.com<BR>> > www.greenwoodmap.com<BR>> >
_______________________________________________<BR>> > mapserver-users
mailing list<BR>> > mapserver-users@lists.osgeo.org<BR>> >
http://lists.osgeo.org/mailman/listinfo/mapserver-users</FONT></TT></BLOCKQUOTE></BODY></HTML>