On Jun 9, 2012, at 10:41 PM, Michael Bayer wrote:

> it looks great.
> 
> This is in the queue as http://www.sqlalchemy.org/trac/ticket/2502.


1765                text += " MATCH %s" % constraint.match 

SQL injection? Shouldn't the argument be one of three constants?

I suspect there needs to be some specific per-database-driver logic to handle 
unimplemented cases. PostgreSQL, for example, doesn't support MATCH PARTIAL ( 
http://www.postgresql.org/docs/9.1/static/sql-createtable.html ) and MySQL, 
naturally, completely ignores the syntax and triggers other clauses to be 
ignored:

"For users familiar with the ANSI/ISO SQL Standard, please note that no storage 
engine, including InnoDB, recognizes or enforces the MATCH clause used in 
referential integrity constraint definitions. Use of an explicit MATCH clause 
will not have the specified effect, and also causes ON DELETE and ON UPDATE 
clauses to be ignored. For these reasons, specifying MATCH should be avoided."
http://dev.mysql.com/doc/refman/5.5/en/create-table.html

Cheers,
M



-- 
You received this message because you are subscribed to the Google Groups 
"sqlalchemy" group.
To post to this group, send email to sqlalchemy@googlegroups.com.
To unsubscribe from this group, send email to 
sqlalchemy+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/sqlalchemy?hl=en.

Reply via email to