Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:3922
Return-Path: <abies@php.net>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 50287 invoked by uid 1007); 14 Aug 2003 09:31:02 -0000
Message-ID: <20030814093101.50285.qmail@pb1.pair.com>
To: internals@lists.php.net
References: <200308071447.03285.ilia@prohost.org> <20030814072704.49157.qmail@pb1.pair.com>
Date: Thu, 14 Aug 2003 11:31:14 +0200
Lines: 17
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-Posted-By: 80.126.21.70
Subject: Re: PHP 4.3.3RC3 Released
From: abies@php.net ("Ard Biesheuvel")

> What about hacking somehow the sqlite library to disallow chained
queries
> (or at least do it optionally)?

If you are unable or unwilling to verify the safety of your input,
use a database that supports params + binding (like Firebird :-))

Any input obtained from the client should be considered unsafe
(== tainted in Perl) and should be checked for correctness first.
In the described case, casting the value to a number if it's
expected to be numerical or putting quotes around it if it's expected
to be a string value will solve your problem. Disallowing chained
queries will prevent *every* developer from ever using it.

Ard