On Mon, 10 Dec 2007, Hans-Christoph Steiner wrote:
For a place where you are expecting a number, you can protect against a SQL injection attack by merely putting a [float] before the message box with the SQL in it. In other situations, I think that Perl has a pretty decent idea: a "SQL quote" function.
Perl has also a pretty decent idea, which is to allow placeholders, which automatically quotes so that you don't have to do it nor even think about it. I rarely ever wrote any Perl code that would access a SQL database in any other way than using placeholders. It's for safety but also not to have to think about strings, so that using SQL feels most like using an array.
I know that you know about Perl's (and most any other's) placeholders, but I really mean that one should almost never have to use [sqlquote] at all, and things are easier if one doesn't have to use it.
- the names ones could be supported as selectors to the hot inlet:
what about selectors that conflict with existing functionality of the object? e.g. if a column is called "symbol" or whatever... what about columns with the same name as methods that will be defined in future versions of [psql] ?
_ _ __ ___ _____ ________ _____________ _____________________ ... | Mathieu Bouchard - tél:+1.514.383.3801, Montréal QC Canada