Cetin,

I recently finished a project that among other things required the loading of flat files into Oracle tables. The best method for doing this is using an Oracle utility called SQL*Loader. When I spoke to the developer in charge of this, he had no idea what I was talking about. He did all his loading with Java. He had a couple of data loads that were about 19,000 records. He had written Java scripts that took 30 minutes per load to complete. To demonstrate SQL*Loader, I created an SQL*Loader script that loaded all the data in about a minute. Needless to say, he was amazed.

All the processing they did was done in Jave with little or no processing done within the Oracle database. The users were complaining about the speed. I am a firm believer that if the database has the utilities to do what you need then use them; if not then use the front-end to do it.

The entire organization's databases are written in this manner.

>Bill,
>Oracle was the biggest by a far margin and still it may be leading but the gap is closing fast. On windows platforms SQL is already ahead by a far margin. Oracle kept its doors closed to developers for a long time and only recently opened the gate. You may expect same for Oracle in near future. But that is also related with enthusiasms of attackers to be doing that against MS I think. Those hackers wouldn't be "proud" hacking Linux/Unix systems but MS.
>And of course another factor is directly the SQL server developer population themselves. Think of ADO and later .Net and its tools have brought many developers on the scene who maybe doesn't know how to write a single SQL line. MS existing documentation, now changing fast in the right direction, gave almost any sample in nonsecure ways in the past. Especially newbies simply trusted and adapted those code into their systems.
>Cetin
>
>
>>Thank you for providing a possible answer. I am not against SQL Server but was wondering why there are large-scale SQL injection atacks on SQL Server but I have never heard of any on Oracle, DB2, etc.
>>
>>>This reminds me some guys who were saying it is impossible to see viruses on unix systems:) Might it be that SQL server has greater market share on windows systems (like 70+%) and also OS share is towards MS. In other words if there are more SQL server installations then there is much more chance to see it on SQL server systems rather than Oracle.
>>>Cetin
>>>
>>>>I am not saying that Oracle can not be affected by an SQL injection attack. It can be just a susceptible as SQL Server is.
>>>>
>>>>But when there are SQL injection attacks on the massive scale why does it always seem to be with SQL Server?
>>>>
>>>>>It is incorrect to think that Oracle cannot be affected by SQL Injection.
>>>>>
>>>>>>Greetings,
>>>>>>
>>>>>>These links say it all:
>>>>>>
>>>>>>http://www.informationweek.com/news/showArticle.jhtml;jsessionid=Z1O1GX5OZ4VR4QSNDLRSKHSCJUNN2JVN?articleID=205600157
>>>>>>
>>>>>>http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9055858&intsrc=hm_list
>>>>>>
>>>>>>Regards,