bigpresh / bigpresh/Dancer-Plugin-Database

Scalar refs for calling SQL functions avoiding quoting/placeholders

Open
#17 1 comment 0 reactions 0 assignees View on GitHub
wishlist
Dominant language
Perl
Stars
39
Forks
36
PR merge metrics
No merged PRs in 30d

Description

Currently, all values passed to `quick_insert` / `quick_update` are handled using placeholders, which means you can't call SQL functions - for instance:

```
database->quick_insert('log', { datetime => "DATETIME('now')", msg => $msg });
```

... will not work, because you can't use function calls as parameter values.

It should be possible to provide scalar refs as values, to indicate that the value should be used in the query verbatim, for instance:

```
database->quick_insert('log', { datetime => \"DATETIME('now')", msg => $msg });
```

It should of course be clearly documented that this means the value you pass is used verbatim, so incorrect use of it can lead to SQL injection vulnerabilities - for example:

```
# Horribly wrong:
database->quick_insert('log', { foo => \$bar });
```

... if `$bar` came from untrusted input, you have an SQL injection vulnerability right there.

The other alternative implementation would be passing a hashref containing the value and a `quote` option, e.g.:

```
database->quick_insert('foo', { datetime => { value => "DATETIME('now')", quote => 0 } ... });
```

A simple scalar reference is probably easier, though.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.