5 Mar 2007 22:10
_adodb_column_sql and integers?
Jon Coulter <ledjon <at> ledjon.com>
2007-03-05 21:10:17 GMT
2007-03-05 21:10:17 GMT
I'm using the postgresql driver, and whenever I pass a value to AutoExecute(...), the adodb driver gets really lazy at the _adodb_column_sql() step (which is what I want to do :))
Basically, if I have a field defined as an integer in the database, but I let '10a' pass into the system, I would rather adodb quote the data before sending it to the server (set intfield = '10a') and let the database throw an error, then postgres assuming I have done the correct casting and passing it as (set intfield = 10a), which is what it does.
This would leave a lot of room for SQL injection bugs. One of the main reasons I want to use an abstraction library like adodb is so I don't have to be hugely tedious with casting data types and things like that. Granted, I'm being lazy in this case, but the fact remains that this is a big problem for people whom just didn't "test" their code well enough and relied on adodb to properly quote things, regardless of what the meta information about the table says the data type is.
I've also never seen a database throw an error if a column is defined as an int, and an int is passed to it in quote ('123') -- so I don't see any problem with just forcing a quoting policy across all non-special-case data types (BLOB is a special case) and letting the rest of us concentrate on business logic instead of data type casting in a loosely-typed language like PHP.
Anybody else have thoughts on this, or similar experiences?
------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________ ADodb-general mailing list ADodb-general <at> lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/adodb-general
RSS Feed