Best practices to mitigate SQL injections on forms

As far as I've ever seen, any on-form input text is sanitized internally such that SQL injection shouldn't be easily possible - though I'll admit I haven't tried very hard to test this. Have you observed evidence to the contrary?

I also, copy Mike. We used to have this issue in non-appian website as mostly Java script is there. In apian forms, sql statement does not execute, as far as I aware..

@Mike Schmitt - No we haven't tested this. Our security dept is setting some guidelines for application developers to guard against SQL injections but I was hoping this was handled by things like an application firewall so that we don't have to code anything specific in our forms

Hi garym I agree with Mike, however even in curious case, suppose if an Appian Text Field accepts the Injection code(i don't think so), in such case also you are not going to face any issues, because the injection code will be treated as a normal Text value similar as any other text values such as fName, lName etc.. stored in DB.

So, i don't think, you need to bother about this.

SQL injection protection is more about how you interact with the database than with how you collect data in a form. Whenever you interact with a database using Appian's out-of-the-box database functionality (like a!queryentity(), query rules, the write to data store smart service, etc), Appian uses prepared statements and parameterized queries when it actually talks to the database. This is the standard way to protect against SQL injection and is recommended by OWASP: www.owasp.org/.../SQL_Injection_Prevention_Cheat_Sheet.

Long story short, if the way you interact with the database is solely through out-of-the-box functionality then you don't need to worry about adding input validation to all of your forms as the platform will handle the SQL injection protection for you.

If you're passing the user-entered data through a plug-in or over a web service or through some other mechanism that does not use Appian's out-of-the-box database interactions, SQL injection might be a concern depending on how that plug-in or service is implemented.