On 12/10/07,
Jamie Bullock <jamie@postlude.co.uk> wrote:
Good point! I think Hans' recent suggestion addresses the problem. It
also occurs to me that for Postgres at least, we have the PREPARE
statement, which addresses the optimisation and injection issues you
have raised. Technically [psql] already supports PREPARE except that
PREPARE uses the '$' character as its placeholder identifier, and '$1'
can't be passed around as a symbol in Pd. I think it might be
interesting to use the '?' notation currently under discussion as an
interface to PREPARE though.
One of the things that I have been reading on this is that when you use these 'pre-complied' SQL statements, you need to 'bind' each of the variables with their types to a specific function. (Also, I kind of like the ':' syntax, as it puts a name to the data within the statement.) I also think that we would need to do something like
[insert into table (id, name) values (:id, :name) ( <-- sent to the cold inlet
[bind :id float( <-- sent to hold inlet
[bind :name symbol( <-- sent to hold inlet
[:id 1 ( <-- sent to hold inlet
[:name john ( <-- sent to hold inlet
[bang ( <-- sent to hold inlet
and then we would be able to put all the data into the database with the expected types. At least SQLite and libdbi use these 'bind' functions to associate the expected datatype with the input data.
Mike
Jamie
--
www.postlude.co.uk
_______________________________________________
PD-list@iem.at mailing list
UNSUBSCRIBE and account-management ->
http://lists.puredata.info/listinfo/pd-list