stored procedures are a defense against sql injection.
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet#Defense_Option_2:_Stored_Procedures
however thoughout the codebase anywhere we generate an sql statement we
should be using params like this
http://guyharrison.squarespace.com/blog/2010/1/17/best-practices-with-python-and-oracle.html
I tested this PR  the email validation wont let a space in to do something
like 'blah@blah.com; drop table test_table'
and in your comment below  because of the stored procedure 'kit_id; drop
table test_table; does not work either.


On Tue, Apr 15, 2014 at 11:16 AM, Daniel McDonald
<notifications@github.com>wrote:

> In www/americangut/forgot_password.psp:
>
> > +from time import strftime
> > +from utils.mail import send_email, can_send_mail
> > +from string import letters, digits
> > +from urllib import quote, unquote
> > +
> > +%>
> > +<script type="text/javascript">
> > +function validatePassRequest() {
> > +    for(var i = 0; i < document.resetpass_request.length; i++)
> > +    {
> > +        document.resetpass_request[i].className = document.resetpass_request[i].className.replace(/(?:^|\s)highlight(?!\S)/ , '');
> > +    }
> > +
> > +    var valid = true;
> > +
> > +    if(!validateEmail(document.resetpass_request.email.value))
>
> just curious, does validateEmail do any sql scrub?
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/qiime/qiime_web_app/pull/607/files#r11645696>
> .
>