Re: Oracle 9i Union Flaw

[Brandon Petty <bmpfg8@xxxxxxx>]

In-Reply-To: <20040930224011.21783.qmail@xxxxxxxxxxxxxxxxxxxxx>

>A fellow student, here at UMR, has tested the MSAccess 2K/XP Union Flaw 

If you are wondering about the Access Union Flaw... I posted something that 
was, for the most part, incorrect about Access and how it handles Unions.  
There are a few quirks... but nothing that should have been posted.  Mainly, my 
bad.

I still think that if you are going to union two fields... that the results 
should not be stored under one of those fields headings if they are different.  
Like doing a union on Login and Password.  It would be best to return the 
results under something like LoginKey instead of Login.  That way if I do an 
SQL Injection by using the ever popular Union operator... I know that I am not 
going to return other data if I print out the contents of the Login results.  
This of course would have to be done by the dbs.

The issue with Oracle 9i not allowing you to miss match more than two fields is 
still strange.  I don't remember what the exact errors where.  This could be a 
flaw in Oracle... but I have not looked into this.  I wouldn't think it would 
matter how many differing fields you union on.  But then again... I really 
haven't look into Oracle to say too much.