Re: [sqlite] Doing math in sqlite

2018-12-20 Thread Dingyuan Wang
You can use recently supported window function (portable): SELECT * FROM ( SELECT car, lag(date) OVER w last_date, date, od_reading - (lag(od_reading) OVER w) diff FROM mileage WINDOW w AS (PARTITION BY car ORDER BY date) ) q WHERE diff IS NOT NULL; 2018/12/21 11:48, Jungle Boogie: >

Re: [sqlite] Claimed vulnerability in SQLite: Info or Intox?

2018-12-20 Thread Keith Medcalf
Only if the application were so badly written as to permit the execution of untrusted code ... --- The fact that there's a Highway to Hell but only a Stairway to Heaven says a lot about anticipated traffic volume. >-Original Message- >From: sqlite-users [mailto:sqlite-users-

Re: [sqlite] Doing math in sqlite

2018-12-20 Thread Barry
The following will give you information pretty much as your example: car, start date, end date, distance. SELECT m1.Car, m2.Date AS StartDate, m1.Date AS endDate, m1.od_reading - m2.od_reading AS distance FROM mileage AS m1 JOIN mileage AS m2 ON m2.rowid = (SELECT rowid FROM mileage m3 WHERE

Re: [sqlite] Doing math in sqlite

2018-12-20 Thread Keith Medcalf
On Thursday, 20 December, 2018 17:32, Jens Alfke wrote: >> On Dec 20, 2018, at 4:21 PM, Jungle Boogie wrote: >> select od_reading from mileage where car='foo' limit 1 >> select od_reading from mileage where car='bar' order by od_reading >> desc limit 1 >Note: the first query should use

Re: [sqlite] Doing math in sqlite

2018-12-20 Thread Jungle Boogie
On Thu 20 Dec 2018 6:26 PM, Barry Smith wrote: > > > > On 20 Dec 2018, at 4:21 pm, Jungle Boogie wrote: > > > > Hi All, > > > > Some sample data: > > 2018/04/15,foo,170644 > > 2018/04/15,bar.69625 > > 2018/04/22,foo,170821 > > 2018/04/22,bar,69914 > > 2018/04/29,foo,171006 > >

Re: [sqlite] Need setup code for VC++ 2017 that will ACTUALLY COMPILE

2018-12-20 Thread zydeholic
Thank you, Donald.  I found something similar in a search, after someone pointed out my problem was VC++.   I went and set PCH off for both my C and CPP files. I no longer get the PCH messages.  I now get this error: Severity    Code    Description    Project    File    Line    Suppression

Re: [sqlite] Doing math in sqlite

2018-12-20 Thread Barry Smith
> On 20 Dec 2018, at 4:21 pm, Jungle Boogie wrote: > > Hi All, > > This is more of a how do I do this in sql question. I apologize in advance > for a simple question, but I need to learn somehow, so any pointers are > appreciated. > > My very simple schema: > > CREATE TABLE mileage ( >

Re: [sqlite] Need setup code for VC++ 2017 that will ACTUALLY COMPILE

2018-12-20 Thread zydeholic
Thanks.  Perhaps you're right, but then they probably won't know much about sqlite, and I'll be at another dead end.  And someone on here just said they used VC++ all the time for this, so perhaps they can point me in the right direction. From: Jens Alfke To: SQLite mailing list

Re: [sqlite] Need setup code for VC++ 2017 that will ACTUALLY COMPILE

2018-12-20 Thread Donald Shepherd
https://stackoverflow.com/questions/7261707/how-to-avoid-precompiled-headers On Fri., 21 Dec. 2018, 1:02 pm zydeholic To Donald Shepard, > Sorry, I'm on digest and am having to just respond to my own messages for > now. Just told it to get me off of digest. > Regarding PCH, VC++ seems to be

Re: [sqlite] Need setup code for VC++ 2017 that will ACTUALLY COMPILE

2018-12-20 Thread zydeholic
To Donald Shepard, Sorry, I'm on digest and am having to just respond to my own messages for now.  Just told it to get me off of digest. Regarding PCH, VC++ seems to be forcing me into that situation (yes, I'm relatively new to C++ and the ins and outs of VS). If I don't include the pch.h in my

Re: [sqlite] Need setup code for VC++ 2017 that will ACTUALLY COMPILE

2018-12-20 Thread Jens Alfke
> On Dec 20, 2018, at 5:34 PM, zydeholic wrote: > > I pulled the two files into a C++ project, deleted the .cpp file, and > compiled. > It came back and said my PCH compiled header was from a previous project, or > something like that. I tried to save the message, but it got lost in the >

Re: [sqlite] Need setup code for VC++ 2017 that will ACTUALLY COMPILE

2018-12-20 Thread zydeholic
Trying again, importing the sqlite3.h and sqlite3.c files directly into the subdirectory created by VC++, and running: Severity    Code    Description    Project    File    Line    Suppression State Error    C1853    'Debug\sqlite_try_3.pch' precompiled header file is from a previous version of

Re: [sqlite] Claimed vulnerability in SQLite: Info or Intox?

2018-12-20 Thread Jens Alfke
> On Dec 20, 2018, at 5:05 PM, Simon Slavin wrote: > > Which would make it do what ? I can imagine "crash with a memory fault". I > find it much harder to believe "execute code stored in the database". You > would have to know a lot about a program to make it do that, and an attack >

Re: [sqlite] Need setup code for VC++ 2017 that will ACTUALLY COMPILE

2018-12-20 Thread Donald Shepherd
PCH/precompiled headers are not related to SQLite. You can try disabling them or looking in how to fix them separately. Regards, Donald Shepherd. On Fri, 21 Dec 2018 at 12:34, zydeholic wrote: > Ok, sorry for my thrashing. I get frustrated when I don't know what's > happening, even when I

Re: [sqlite] Need setup code for VC++ 2017 that will ACTUALLY COMPILE

2018-12-20 Thread zydeholic
Ok, sorry for my thrashing.  I get frustrated when I don't know what's happening, even when I follow directions from a website.  And I tried several things and couldn't remember what errors I got from what venture. To Scott Doctor, I pulled the two files into a C++ project, deleted the .cpp

Re: [sqlite] Claimed vulnerability in SQLite: Info or Intox?

2018-12-20 Thread Richard Hipp
On 12/20/18, Peter da Silva wrote: > Sqlite is explicitly not designed to be secure > against untrusted input or corrupt . This is, perhaps, originally true. But in more recent years we have learned that people feed all kinds of malicious inputs into SQLite and expect it to survive, and indeed

Re: [sqlite] Claimed vulnerability in SQLite: Info or Intox?

2018-12-20 Thread Simon Slavin
On 21 Dec 2018, at 12:40am, Jens Alfke wrote: > From what I’ve read, it sounds like any code using FTS3 was vulnerable to > maliciously crafted SQL statements messing with the shadow tables. Which would make it do what ? I can imagine "crash with a memory fault". I find it much harder to

Re: [sqlite] Doing math in sqlite

2018-12-20 Thread Shevek
For the cost of a single table scan, you may be better with: select max(foo) - min(foo) where etc. S. -- Anyone using floating point for financial computations needs their head examined. On 12/20/18 4:32 PM, Jens Alfke wrote: On Dec 20, 2018, at 4:21 PM, Jungle Boogie wrote: select

Re: [sqlite] Claimed vulnerability in SQLite: Info or Intox?

2018-12-20 Thread Jens Alfke
> On Dec 20, 2018, at 4:46 PM, Peter da Silva wrote: > > Sqlite is explicitly not designed to be secure against untrusted input or > corrupt . That was true a couple of years ago, but SQLite has been hardened since, mostly because of problems in Chromium. "SQLite should never crash,

Re: [sqlite] Claimed vulnerability in SQLite: Info or Intox?

2018-12-20 Thread Peter da Silva
Programs that were written defensively from the start are more likely to survive attack. Programs that have successfully been exposed to attack can be treated as more secure. Sqlite is explicitly not designed to be secure against untrusted input or corrupt . This is OK. It's not a program that

Re: [sqlite] Claimed vulnerability in SQLite: Info or Intox?

2018-12-20 Thread Jens Alfke
> On Dec 20, 2018, at 9:34 AM, Simon Slavin wrote: > > Yes, but you can't program the program which accesses the SQLite API. Your > app, or my app, retrieving that BLOB, wouldn't necessarily try to execute it, > or store the BLOB in exactly the right place in memory for it to do something >

Re: [sqlite] Claimed vulnerability in SQLite: Info or Intox?

2018-12-20 Thread Jens Alfke
> On Dec 20, 2018, at 9:30 AM, Peter da Silva wrote: > > Fuzz testing would be extremely unlikely to have caught the original > attack. Nor would fuzz testing on input be likely to hit all corrupt > database attacks. Fuzz testing using fuzzed corrupted databases might. OK, but by those

Re: [sqlite] Doing math in sqlite

2018-12-20 Thread Jens Alfke
> On Dec 20, 2018, at 4:21 PM, Jungle Boogie wrote: > > select od_reading from mileage where car='foo' limit 1 > select od_reading from mileage where car='bar' order by od_reading desc limit > 1 Note: the first query should use “order by od_reading”, otherwise the order is undefined. A

[sqlite] Doing math in sqlite

2018-12-20 Thread Jungle Boogie
Hi All, This is more of a how do I do this in sql question. I apologize in advance for a simple question, but I need to learn somehow, so any pointers are appreciated. My very simple schema: CREATE TABLE mileage ( date text, "car" text, "od_reading" integer ) Some sample data:

Re: [sqlite] Need setup code for VC++ 2017 that will ACTUALLY COMPILE

2018-12-20 Thread Scott Doctor
Click the link. https://sqlite.org/download.html Download the amalgamation zip file. Unzip to your files directory. Should be two files. sqlite.c and sqlite.h Add #include "sqlite.h" to your file. Compile. - Scott Doctor sc...@scottdoctor.com

Re: [sqlite] Need setup code for VC++ 2017 that will ACTUALLY COMPILE

2018-12-20 Thread Igor Korot
Hi, Unfortunately you didn't tell what did you try to compile, where did you get the files you tried to compile from and you didn't even supply the error message you received from the compilation. Please follow-up and provide this and hopefully someone here will be able to help. Thank you. On

Re: [sqlite] Question about floating point

2018-12-20 Thread Warren Young
On Dec 20, 2018, at 3:38 PM, Igor Tandetnik wrote: > > On 12/20/2018 1:34 PM, Dennis Clarke wrote: >> A more interesting topic of discussion would be the speed and complexity >> of circuitry designed for another number base such as 5 or even decimal. > >

Re: [sqlite] Need setup code for VC++ 2017 that will ACTUALLY COMPILE

2018-12-20 Thread Donald Shepherd
You'll need to provide more information, speaking as someone who compiles the amalgamation off the SQLite website with VC++ 2017 on Windows 10 with no issues. SQLite is C code, not C++ code, but VC++ detects that based off the file extension and compiles it as such. Trying to use whatever

[sqlite] Need setup code for VC++ 2017 that will ACTUALLY COMPILE

2018-12-20 Thread zydeholic
Hello folks, I looked through the last few months of posts in the archive, and no subject lines seemed to cover this. I've tried a couple of CPPSqlite3.cpp and .h from github.com.I've tried code from a couple of websites. NOTHING seems to compile all the way through.  I'm using Visual Studio

Re: [sqlite] Question about floating point

2018-12-20 Thread Igor Tandetnik
On 12/20/2018 1:34 PM, Dennis Clarke wrote: A more interesting topic of discussion would be the speed and complexity of circuitry designed for another number base such as 5 or even decimal. https://en.wikipedia.org/wiki/Ternary_computer -- Igor Tandetnik

Re: [sqlite] Question about floating point

2018-12-20 Thread Dennis Clarke
On 12/19/18 7:51 PM, James K. Lowden wrote: On Tue, 18 Dec 2018 17:34:29 -0500 Dennis Clarke wrote: some serious reading and experiments are needed to get a good handle on why numerical computation is as much art as it is science. If we wander into the problem without sufficient study and

Re: [sqlite] Claimed vulnerability in SQLite: Info or Intox?

2018-12-20 Thread Simon Slavin
On 20 Dec 2018, at 5:27pm, Jens Alfke wrote: > On Dec 19, 2018, at 10:32 AM, Simon Slavin wrote: > >> I'm not sure how you would do that purely inside a trigger. You can't just >> specially craft a BLOB with bad content. I think it would need >> participation from the software making the

Re: [sqlite] Claimed vulnerability in SQLite: Info or Intox?

2018-12-20 Thread Peter da Silva
Fuzz testing would be extremely unlikely to have caught the original attack. Nor would fuzz testing on input be likely to hit all corrupt database attacks. Fuzz testing using fuzzed corrupted databases might. On Thu., 20 Dec. 2018, 11:26 Jens Alfke > > > On Dec 19, 2018, at 4:03 PM, Peter da

Re: [sqlite] Sample Employee database ported to SQLite from MySQL

2018-12-20 Thread Stephen Chrzanowski
Right up until procedures change and the identifier has changed from an integer only data type to something that starts containing characters. There's so many different types of UPCs out there, for example, that a company can switch from an integer only type of UPC to something that contains

Re: [sqlite] Claimed vulnerability in SQLite: Info or Intox?

2018-12-20 Thread Jens Alfke
> On Dec 19, 2018, at 10:32 AM, Simon Slavin wrote: > > I'm not sure how you would do that purely inside a trigger. You can't just > specially craft a BLOB with bad content. I think it would need participation > from the software making the call to the API. Can’t you put [nearly] any SQL

Re: [sqlite] Claimed vulnerability in SQLite: Info or Intox?

2018-12-20 Thread Jens Alfke
> On Dec 19, 2018, at 4:03 PM, Peter da Silva wrote: > > sqlite is not immune to wandering through bad pointers, because code > coverage tests don't test for malicious data.. Fuzz testing does, though [implicitly].

Re: [sqlite] Sample Employee database ported to SQLite from MySQL

2018-12-20 Thread Arun - Siara Logics (cc)
Hi Chris, James, Shawn, Thanks for the suggestions - I think they are quite relevant. I will modify and update soon. I kept the page size as 512 without rowid and dropped foreign keys so I could use it to demo SQLite on a low memory SoC ESP8266 (see

Re: [sqlite] Sample Employee database ported to SQLite from MySQL

2018-12-20 Thread Chris Locke
> Just because something doesn't have to be calculated, means that it has to be stored as text. Sorry - forgot a 'doesn't'. Just because something doesn't have to be calculated, doesn't mean that it has to be stored as text. On Thu, Dec 20, 2018 at 3:42 PM Chris Locke wrote: > Just because

Re: [sqlite] Sample Employee database ported to SQLite from MySQL

2018-12-20 Thread Chris Locke
Just because something doesn't have to be calculated, means that it has to be stored as text. Its usually recommended to set the column affinity to the type of data you're storing. If you're storing a number (and a model number is a numeric number) then it should be stored in a numeric field. If

[sqlite] ALTER TABLE fails when there is an INSTEAD-OF trigger of a VIEW

2018-12-20 Thread Mark Johnson
Based on ticket https://www.sqlite.org/src/tktview?name=43ddc85a63 --- During work for spatialite, I have also run into this problem using version 3.25.3. Today I updated to 3.26.0 and saw that changes were made that (possibly) makes it easier to pinpoint the problem. With 3.25.3 lookupName

Re: [sqlite] Sample Employee database ported to SQLite from MySQL

2018-12-20 Thread James K. Lowden
On Wed, 19 Dec 2018 10:55:11 + Chris Locke wrote: > Fields with '_no' are read as 'number' and so should be a number. > OK, that doesn't always work for 'telephone_no' (they usually start > with a 0 Lots of numbers are labels that aren't meant to be calculated on. Item number, part number,

Re: [sqlite] Exclusive transactions and Select statements

2018-12-20 Thread Simon Slavin
On 20 Dec 2018, at 11:19am, Carsten Müncheberg wrote: > I am experimenting with EXCLUSIVE transactions today, and was confused that > after one connection began an EXCLUSIVE transaction, another one could still > execute a SELECT statement Your database is probably in WAL mode:

Re: [sqlite] [EXTERNAL] Reusing built-in sqlite3_io_methods

2018-12-20 Thread Hick Gunter
Reuse is only possible if your custom VFS's internal file object structure is compatible with struct unixFile as defined in os_unix.c und the selected locking strategy uses the same methods/system calls. So my guess is "probably not", but grabbing code from os_unix.c might be a good starting

[sqlite] Exclusive transactions and Select statements

2018-12-20 Thread Carsten Müncheberg
Hi, I am experimenting with EXCLUSIVE transactions today, and was confused that after one connection began an EXCLUSIVE transaction, another one could still execute a SELECT statement, because quoting from https://www.sqlite.org/lang_transaction.html "After a BEGIN EXCLUSIVE, no other

Re: [sqlite] SQLite Application Question

2018-12-20 Thread R Smith
On Thu, Dec 20, 2018 at 9:05 AM Roger Schlueter wrote: On 12/19/2018 23:01, Chris Locke wrote: What application are you using to build your application? You mentioned Visual Studio, so .NET? If so, are you using the SQLite library from system.data.sqlite.org? Are you using c# or vb?

[sqlite] Reusing built-in sqlite3_io_methods

2018-12-20 Thread Albert Banaszkiewicz
Hello everybody, In our system we use our custom VFS implementation (sqlite3_vfs_register, sqlite3_vfs). Now we would like to come up with locking strategy. And here is the question: Is there a way to reuse one from the set of already implemented in sqlite ? Or is it necessary to write it from

Re: [sqlite] SQLite Application Question

2018-12-20 Thread Chris Locke
I tend to have a class at the table layer, so essentially have a 'settings' class (matching the 'settings' table). My form then (hard coded) grabs the settings it needs. I'd store the location as x,y (so 300,900 for example) and size (so 1000,800 for example). The class handles grabbing

Re: [sqlite] SQLite Application Question

2018-12-20 Thread Roger Schlueter
On 12/19/2018 23:01, Chris Locke wrote: What application are you using to build your application? You mentioned Visual Studio, so .NET? If so, are you using the SQLite library from system.data.sqlite.org? Are you using c# or vb? Yes.  .NET via vb using wpf. I plan to use the library.