OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: logging of BAD queries

From: mos (mos99fastmail.fm)
Date: Tue Feb 09 2010 - 14:57:40 CST


At 09:27 AM 2/9/2010, andy knasinski wrote:
>I've used the general and slow query log in the past, but I am trying
>to track down some queries from a compiled app that never seem to be
>hitting the DB server.
>
>My guess is that the SQL syntax is bad and never get executed, but I
>don't see any related queries in the general query log. Does the
>general log include invalid SQL?

I don't think it does.

>I've also tried to use the driver logging, but on Windows it
>overwrites with the last SQL command so I cannot get a good capture as
>requests are sent to the DB.
>
>DB is MySQL 5.0.x

  I do something like that in my compiled application. All SQL queries are
sent to a single procedures and executed there. I trap any errors and log
the SQL in a table along with the error message. This is useful to
determine if someone is trying to break into the database (sql injection).
Having a central procedure to execute all queries is paramount in
controlling and capturing errors. I can also unplug and plug in a different
database engine quite easily rather than hunting down all direct calls to
the database. I also don't have to worry about trapping errors throughout
the application. It's all done at one central point.

I've been doing it this way for 5 years and would never start a large
application without it.

Mike

--
MySQL General Mailing List
For list archives: http://lists.mysql.com/mysql