As drh indicated, you're already doing what any quote() function would
be doing, so it sounds like you're safe.
My general tendency is to assume that anytime I implement something in
parallel to another implementation, no matter how trivially obviously
identical the implementations are, at some point I'm going to pay a
price (usually because something gets added to the original
implementation and I don't realize I need to change my parallel
implementation). This may-or-may-not be an appropriate amount of
paranoia for any particular project :-).
-scott
On 10/5/07, Andy Goth <[EMAIL PROTECTED]> wrote:
> On Fri, 5 Oct 2007 09:41:27 -0700, Scott Hess wrote
> > On 10/5/07, Andy Goth <[EMAIL PROTECTED]> wrote:
> > > proc sql_expand {varname} {
> > > upvar 1 $varname var
> > > set result [list]
> > > foreach elem $var {
> > > lappend result '[string map {' ''} $elem]'
> > > }
> > > return [join $result ,]
> > > }
> >
> > You really should be using an SQLite-specific quote function
> > somewhere.
>
> I didn't know SQLite provided one. It normally doesn't need one, thanks to
> its internal expansion of Tcl variables. Oh wait, it has quote(), but this
> would not work for me because (by design!) its result is formatted in such a
> way that SQLite interprets it as a single value, *not* a list. Or I could
> invoke it repeatedly, once per element.
>
> But after all that overhead I imagine I would be better off using Tcl to
> expand my data into multiple variables; at least that way all bytecoding gets
> cached and I'm guaranteed to be immune to injection.
>
> > You could work around it by doing something like [db eval {select
> > quote($arg)}], but that feels clunky.
>
> I'm pretty sure I know how SQLite will perform quote()'ing, and I can
> implement it in pure Tcl easily enough, so I might as well leave it in Tcl.
> Tcl should be able to bytecode string manipulation better than SQLite; string
> manipulation is Tcl's raison d'être.
>
> But maybe I'm wrong about how quote() works. Can somebody confirm? In my
> mind, quote($x) is equivalent to '[string map {' ''} $x]' .
>
> > The quoting you're using will work fine for many cases, but are
> > subject to SQL injection attack.
>
> Could you please provide an example?
>
> --
> Andy Goth
> <[EMAIL PROTECTED]>
>
>
> -----------------------------------------------------------------------------
> To unsubscribe, send email to [EMAIL PROTECTED]
> -----------------------------------------------------------------------------
>
>
-----------------------------------------------------------------------------
To unsubscribe, send email to [EMAIL PROTECTED]
-----------------------------------------------------------------------------
