Although the WHERE condition is optional in a SELECT statement, for performance and security reasons, a
WHERE clause should always be specified to prevent reading the whole table.
Ask Yourself Whether
- The whole table is not required.
- The table contains sensitive information.
There is a risk if you answered yes to any of those questions.
Recommended Secure Coding Practices
Add a "WHERE" condition to "SELECT" statements.
Sensitive Code Example
SELECT * FROM db_persons INTO us_persons
Compliant Solution
SELECT * FROM db_persons INTO us_persons WHERE country IS 'US'
Exceptions
Not having a WHERE clause is acceptable in read-only cursors as results are generally sorted and it is possible to stop processing in the
middle.
