Query Template restricted to 32 Params

Question

Hi All,
I have more than 50 Params on Screen to be inserted into database through MII
Solution 1: I can send this as one param by selecting all the variables in one variable (through dynamic SQL Query)
but this is not good practice as it is is not secured due to SQL injection
Solution2 : I can have two tables and distribute the variables from the screen in these two tables (as Query templates restrict me to have 32 Params)
Can anyone suggest me a better solution keeping in mind security and Best Practices
Thanks in advance
Regards
Namita

Answer 1

Hi Namitha,
1) If you are using MSSQL server then you can still go for Dynamic SQL but instead of using your Dynamic SQL statement directly in Query Template Write a Stored procedure and inside procedure write the Dynamic SQL statement passing this as string parameter. And call this stored procedure from Query template.
Since Stored Procedure is stored at server and hence not visible or in-accessible to anyone or end user
So chances of SQL injection is minimal or no chance.
2) But If you are using Oracle then you can do something like this:-
Assuming that you are not sure of how many rows you need to insert. It comes on fly from front-end.
Say for example, you need to insert two rows, each row having 50 or more fields(columns).
In JavaScript write a small routine in which you append each field separated by comma( , ) or any character you feel convenient and then prepare the second row in same way and then append it with first row separated by semicolon( ; ) or any character you feel convenient.
follow same approach for any number of rows using loops.
So you will get just one Parameter string carrying all the rows and fields.
Pass this to a stored procedure thru query template.
and perform this logic
char_position := instr(STR,',');
field_value :=to_number(substr(STR,1,char_position-1));
STR := substr(STR,char_position+length(','));
Use the above code for un-stringing or to get the rows appended.
then use the above same code within each row and loop untill you finish un-stringing all the rows.
where STR is your appended string passed from front-end.
Hope this helps!!
Regards,
Adarsh S P