{"id":8,"date":"2013-10-02T20:34:11","date_gmt":"2013-10-02T20:34:11","guid":{"rendered":"http:\/\/www.w3.org\/community\/rdfjs\/?p=8"},"modified":"2013-10-02T20:34:11","modified_gmt":"2013-10-02T20:34:11","slug":"whats-the-best-way-to-parameterize-sparql-queries","status":"publish","type":"post","link":"https:\/\/www.w3.org\/community\/rdfjs\/2013\/10\/02\/whats-the-best-way-to-parameterize-sparql-queries\/","title":{"rendered":"&#8220;What&#8217;s the best way to parameterize SPARQL queries?&#8221;"},"content":{"rendered":"<p><a href=\"http:\/\/www.reddit.com\/r\/semanticweb\/comments\/1e3fq0\/whats_the_best_way_to_parameterize_sparql_queries\/\" target=\"_blank\" rel=\"nofollow\">http:\/\/www.reddit.com\/r\/semanticweb\/comments\/1e3fq0\/whats_the_best_way_to_parameterize_sparql_queries\/<\/a><\/p>\n<p>The gist: as a tokenized query protocol, it is not &#8216;safe&#8217; to build SPARQL queries by concatenating strings which may contain user-supplied input.<\/p>\n<p>In SQL, this is called &#8220;SQL Injection&#8221;:<\/p>\n<ul>\n<li><a href=\"http:\/\/cwe.mitre.org\/data\/definitions\/89.html\" target=\"_blank\" rel=\"nofollow\">CWE-89: Improper Neutralization of special elements used in an SQL command (&#8216;SQL Injection&#8217;)<\/a><\/li>\n<li><a href=\"http:\/\/cwe.mitre.org\/top25\/#CWE-89\" target=\"_blank\" rel=\"nofollow\">http:\/\/cwe.mitre.org\/top25\/#CWE-89<\/a><\/li>\n<\/ul>\n<p>It may be tempting to suggest that this is not an issue for read-only SPARQL queries, but resource exhaustion can also be a very real concern; especially with RDF JavaScript Libraries which are used to prepare queries.<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>http:\/\/www.reddit.com\/r\/semanticweb\/comments\/1e3fq0\/whats_the_best_way_to_parameterize_sparql_queries\/ The gist: as a tokenized query protocol, it is not &#8216;safe&#8217; to build SPARQL queries by concatenating strings which may contain user-supplied input. In SQL, this is called &#8220;SQL Injection&#8221;: CWE-89: Improper Neutralization of special elements used in an &hellip; <a href=\"https:\/\/www.w3.org\/community\/rdfjs\/2013\/10\/02\/whats-the-best-way-to-parameterize-sparql-queries\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":5236,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_s2mail":"yes","footnotes":""},"categories":[1],"tags":[],"class_list":["post-8","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.w3.org\/community\/rdfjs\/wp-json\/wp\/v2\/posts\/8","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.w3.org\/community\/rdfjs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.w3.org\/community\/rdfjs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.w3.org\/community\/rdfjs\/wp-json\/wp\/v2\/users\/5236"}],"replies":[{"embeddable":true,"href":"https:\/\/www.w3.org\/community\/rdfjs\/wp-json\/wp\/v2\/comments?post=8"}],"version-history":[{"count":1,"href":"https:\/\/www.w3.org\/community\/rdfjs\/wp-json\/wp\/v2\/posts\/8\/revisions"}],"predecessor-version":[{"id":9,"href":"https:\/\/www.w3.org\/community\/rdfjs\/wp-json\/wp\/v2\/posts\/8\/revisions\/9"}],"wp:attachment":[{"href":"https:\/\/www.w3.org\/community\/rdfjs\/wp-json\/wp\/v2\/media?parent=8"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.w3.org\/community\/rdfjs\/wp-json\/wp\/v2\/categories?post=8"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.w3.org\/community\/rdfjs\/wp-json\/wp\/v2\/tags?post=8"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}