I have a workorder management system (WMS).
- The WMS has functionality that allows users to save queries.
- The queries are saved in a database table called
An example of a value in the
CLAUSE column would be:
((woclass = 'WORKORDER' or woclass = 'ACTIVITY') and contains(description,'$paint') > 0 and historyflag = 0 and istask = 0 and siteid = 'SERVICES')
I'm trying to learn how to properly integrate the WMS system with a separate GIS system (both systems are broswer-based/Oracle/internal systems).
- From a drop-down menu, choose a WHERE clause name from the
QUERYtable, extract the value from the
CLAUSEcolumn, and use it in a customized filtering tool (to query a GIS table).
Would the above-mentioned GIS widget be vulnerable to injection? If so, what can I do to make it safe?
I'm new to the IT industry and am trying to learn how to safely integrate/share queries between systems. Layman's terms would be appreciated.