You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: scenarios/basics/redshift/SPECIFICATION.md
+29Lines changed: 29 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,6 +13,20 @@ The following user input is required for this SDK getting started scenario:
13
13
- The year to use to query records from the database.
14
14
- Whether or not to delete the Amazon Redshift cluster.
15
15
16
+
## SQL Statement Requirements
17
+
18
+
All SQL statements that include user input or variable data MUST use parameterized queries to prevent SQL injection vulnerabilities. This applies to:
19
+
20
+
- INSERT statements when adding movie records (use parameters for id, title, and year values)
21
+
- SELECT statements when querying by year (use parameters for the year value)
22
+
- Any other SQL operations that incorporate dynamic values
23
+
24
+
Example of parameterized query usage:
25
+
- Instead of: `SELECT * FROM Movies WHERE year = 2013`
26
+
- Use: `SELECT * FROM Movies WHERE year = :year` with a parameter binding for `:year`
27
+
28
+
This security best practice ensures that user input is properly escaped and prevents malicious SQL code injection.
29
+
16
30
## Hello Redshift
17
31
This program is intended for users not familiar with the Redshift SDK to easily get up an running. The logic is to show use of `redshiftClient.describeClustersPaginator()`.
18
32
@@ -148,6 +162,21 @@ This concludes the Amazon Redshift SDK Getting Started scenario.
148
162
149
163
```
150
164
165
+
## Exception Handling
166
+
167
+
The following table lists the exceptions that should be caught and handled for each action in the scenario:
0 commit comments