...
| Warning | ||
|---|---|---|
| ||
When using Hash Variable that uses URL parameter or user-inputted value in the SQL query, ensure that these hash variable(s) are escaped in the query! Make use of hash variable escape keywords, see Hash Variable - Escaping the Resultant Hash Variable. Example of VULNERABLE query :
To fix this, use ?sql hash variable escape:
|
Introduction
Database SQL Query, formerly known as JDBC Form Binder allows you to use custom SQL statements to retrieve and load records into your form fields. Similarly, you can write SQL statements to save the records in your form field into a database table.
JDBC form binders Database SQL Query settings are located in the form PROPERTIES tab under "Advanced > Data Binder > Load Binder & Store BinderData From & Save Data To". JDBC JDBC form binders replaces the standard Workflow Form Binder.
...
JDBC Binders comes standard in Joget v6 and DX. If you are using Joget v5, you can download the JDBC Binders from Joget Marketplace.
Figure 1: JDBC Binder Database SQL Query selected as Load Data From & Save BinderData To
JDBC Binder Properties
Configure JDBC Load Binder
Figure 2: Configure JDBC Binder
...
Configure JDBC Store Binder
Figure 3: Configure Store JDBC Binder
...