Re: SQL configurations in automated testing "A bit OT"

[Gavin]

Nice post ++ and a great test idea which I’m afraid I can’t help you with but am sure others can and will.

But as a side issue I would be interested in your and other Monks opinion regarding the security vulnerabilities (Cross-Site Scripting, Injection etc) in the various variations of SQL "Postgres, MySQL, SQLite etc" when used for a web application and which would be first choice for security and ease of use.

[dragonchild]

Your choice of data storage has no relationship with your vulnerability to XSS. The only vulnerability you really care about (from a programming perspective) when picking a RDBMS is SQL Injection and that's solved by DBI. Anything else is the purview of your DBA (you do have one, right) and your sysadmin (you do have one of those, too, right).

[skazat]

Like they said. Run your program in Taint mode and use placeholders in queries. That should hit most of your worries.