CRITICAL
Rule Definition
SQL queries can raise exception. If they are not properly catched, the troubleshooting get harder and thus cost is higher.
This rule works at the local level. Which means that if the function is called by another function ,and the call is inside a try-on block, it is still a violation because Try-Catch must be implemented at the lowest level of processing to allow fine-grained specialization in exception handling.
Remediation
Add try-on block outside the SQL query
Violation Code Sample
function TEST1()
TESTTEST1.T1 = "MMMM";
with #sql{ //VIOLATION
INSERT INTO TEST2
( select * from abcd
}
$end
Fixed Code Sample
function TEST1()
TESTTEST1.T1 = "MMMM";
try //FIXED
with #sql{
INSERT INTO TEST2
( select * from abcd
}
onException
...........
end
$end
Reference
EGL Best Practices: Coding For Performance. November 10, 2009. Edition 2
Related Technologies
Technical Criterion
PCI-DSS4-Requirement-6.2.4 - Software engineering techniques or other methods are defined and in use by software development personnel to prevent or mitigate common software attacks and related vulnerabilities
About CAST Appmarq
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.