TEC Workbook - IBM

IBM Software
The processing policy should now look like the following image.
__5. Click the Apply Policy button to make your changes active.
__6. In the soapUI request window, load the request from c:\labs\requests\missingDp.xml.
Notice that the brand is missing the word “DataPower”.
__7. Click the green submit button to POST the request to MyServiceProxy. You should receive a
SOAP fault with an error message as shown in the following image.
2.5.1 SQL Injection Threat Filtering
SQL Injection is an attack technique used to exploit Web sites and services that construct SQL
statements from user-supplied input. For example, assume that a web service expects a SOAP request
containing a element used for looking up a customer.
KAPLAN
The Web service uses an SQL statement with substitution parameters similar to the following SQL
snippet:
SELECT * FROM EMPLOYEE WHERE LASTNAME = ?
After the substitution takes place, the resultant SQL statement will be:
SELECT * FROM EMPLOYEE WHERE LASTNAME = 'KAPLAN'
However, if the value submitted in the element contained a malicious SQL injection threat, it
may look like this:
KAPLAN’ OR ‘1’=’1
Page 44 WebSphere Lab Jam