I think one of the first exercises when customizing Windchill is making use of Queryspec API to search for objects in the database. Given a number string, find me the Parts that match and do something with them. If we are taking input from the browser, what consideration must we do so that we do not open ourselves up to SQL Injection? Does the API already handle this for us internally?
Given that I am providing the where clause a string value directly from the user's input, how do we make sure it does not contain another SQL statement? Is that where its done, checking before adding to where clause? I know that we can put checks on any exceptions that are thrown from bad input that can expose data. Just curious where developer's responsibilities lie and what PTC has already handled.
