bigpresh / bigpresh/Dancer-Plugin-Database
Scalar refs for calling SQL functions avoiding quoting/placeholders
- Dominant language
- Perl
- Stars
- 39
- Forks
- 36
- PR merge metrics
- No merged PRs in 30d
Description
Currently, all values passed to `quick_insert` / `quick_update` are handled using placeholders, which means you can't call SQL functions - for instance:
```
database->quick_insert('log', { datetime => "DATETIME('now')", msg => $msg });
```
... will not work, because you can't use function calls as parameter values.
It should be possible to provide scalar refs as values, to indicate that the value should be used in the query verbatim, for instance:
```
database->quick_insert('log', { datetime => \"DATETIME('now')", msg => $msg });
```
It should of course be clearly documented that this means the value you pass is used verbatim, so incorrect use of it can lead to SQL injection vulnerabilities - for example:
```
# Horribly wrong:
database->quick_insert('log', { foo => \$bar });
```
... if `$bar` came from untrusted input, you have an SQL injection vulnerability right there.
The other alternative implementation would be passing a hashref containing the value and a `quote` option, e.g.:
```
database->quick_insert('foo', { datetime => { value => "DATETIME('now')", quote => 0 } ... });
```
A simple scalar reference is probably easier, though.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.