Beefy Boxes and Bandwidth Generously Provided by pair Networks
XP is just a number
 
PerlMonks  

Comment on

( #3333=superdoc: print w/ replies, xml ) Need Help??

Tainting would also have been my answer to the problem of mixing untrusted user input with SQL fragments.

For constants (your "hard-coded literals"), I really don't care. I've used DBI nearly daily in the last few years, and I rarely needed constants. And for the few cases where I really had constants, I replaced them with placeholders and a constant bind value just because I have the habit to pass all values using placeholders. So having DBI warn or die when it finds a string or number literal in an SQL statement would not hurt much, it would just force you to pass even constants via placeholders. Of course, this "paranoia mode" would break some existing code, and it needs to be disabled by default for a long time. Any by the way: Because no user code needs the $dbh->quote() method in "paranoia mode", DBI should warn or die when non-DBD code calls this method.

I see a different problem that really blocks the implementation of this "paranoia mode": The different SQL dialects. For example, it is possible and sometimes needed to create PL/SQL code via DBI/DBD::Oracle, and that code may legally contain any hard-coded literal. So the actual parsing has to be done in the DBD code, at least for those special cases. DBI code may provide a default parser, for DBDs that don't have those special cases.

Alexander

--
Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)

In reply to Re^3: Counting rows Sqlite by afoken
in thread Counting rows Sqlite by fanticla

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post; it's "PerlMonks-approved HTML":



  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • Outside of code tags, you may need to use entities for some characters:
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.
  • Log In?
    Username:
    Password:

    What's my password?
    Create A New User
    Chatterbox?
    and the web crawler heard nothing...

    How do I use this? | Other CB clients
    Other Users?
    Others lurking in the Monastery: (4)
    As of 2014-09-23 08:27 GMT
    Sections?
    Information?
    Find Nodes?
    Leftovers?
      Voting Booth?

      How do you remember the number of days in each month?











      Results (212 votes), past polls