Security and birt

vmlinux

I'm writing up a study for my company to compare birt, jasper reports, and our current e.Report designer product. I'm rewriting a report in each to get an idea of what we are going to be dealing with, and I'll make a recommendation to the uppers on what to migrate from erd pro to.

Most of our reports need to allow customers to list ID numbers in a list, and I've looked at the in_clause.rptdesign example, and I think I could make it work for me, however I'm concerned about SQL injection checking. Is there anything in Birt that checks for server side scripting on parameter strings, or SQL injections on parameters, or would I have to write something to do that, or do all the checking in java script?

I know in erd pro if you parametrize the string then it is checked, but if you insert it into your where clause then you open yourself up to attack if there is no additional checking on the string.


Thank you
David Carroll

mwilliams

David,

You'll have to do your checking of the parameter in your scripting. You can just do this where you write the script for the IN clause.