Repository navigation
Prevent SQL injections #73
Description
Currently column objects are responsible for escaping and quoting values which does not work. I would suggest the following design change.
- Change Columns
getValue()method to alway return it’s raw values and do no quoting our escaping - Let columns hint if a value is meant to be strictly or partially matched against a source (
=orLIKEin SQL) - Make Sources responsible to do the right thing with values
Comments?
Activity
lstrojny commentedon Jan 21, 2012
I’m not sure this would work as various sources may have different control characters. As the columns are responsible for doing everything a column should do, it looks like violating clean responsibilities to let them filter data, especially since the appropriate filter result depends on the source.