[PD] [psql] object hand-holding

[Mathieu Bouchard]

On Mon, 10 Dec 2007, Hans-Christoph Steiner wrote:

> The other somewhat common style that I saw in my searches was printf patterns 
> (%s, %f, etc).  In Pd, [makefilename], [makesymbol], [sprintf], and perhaps 
> others use this syntax.  The single ? notation seems to be supported by at 
> least these, if you want to call that "specific":  Qt, PerlDBI, Perl's 
> DBD::Pg, RubyDBI, PHP PDO, Java JDBC, MySQL, Oracle.

Well, maybe I shouldn't have said "specific", but when I look at any PHP 
code that I find, it seems that they haven't discovered what's a 
placeholder yet, for example. So, it seems that it's not so universal.

> I think it is quite important to reuse existing syntax rather than 
> introducing new syntax.  Minimal syntax is really one of Pd's biggest 
> strengths.  Since these lines would be pure SQL, I think it would be 
> appropriate to use a common SQL syntax.

If you wanted to reuse existing Pd syntax, you could abstract out SQL 
syntax completely and make a database interface that fully feels like Pd. 
The Rails web framework has something like that.

> I just had a thought, SQL injection relies on being able to send semi-colons 
> in text fields.

This is not true. I have already posted an example in this thread on how 
to delete a whole table using SQL injection without a semicolon.

> You can't transmit a semicolon in a message in Pd,

This is not true. You can't type one in a messagebox, that's all. You can 
make one anytime with [makefilename]. You can edit a pd file and insert a 
sufficiently backslashed semicolon and it will appear.

Also, a non-backslashed semicolon in an objectbox is parsed as a symbol of 
1 character and it is passed as an argument to the newmethod. Calling a 
newmethod is to send a message.

> then no one will ever be able to send a semi-colon to [sqlite]/[psql]. 
> Pd would always interpret the semi-colon before the object received it 
> on its cold inlet. AFAIK, that eliminates basically all of the really 
> bad SQL injection attacks.

Dream on!

  _ _ __ ___ _____ ________ _____________ _____________________ ...
| Mathieu Bouchard - tél:+1.514.383.3801, Montréal QC Canada