Re: [webdatabase] wording on "Parsing and processing SQL statements" section

On Fri, 25 Sep 2009, João Eiras wrote:
> 
> In section "4.2 Parsing and processing SQL statements", point 2 starts as
> "Replace each ? placeholder" but then says later "Note: Substitutions for
> ? placeholders are done at the literal level, not as string
> concatenations".
> By using the word "replace", that execution step may cause confusion, as
> I've seen, about people thinking it might be related to some sort of
> concatenation, although the specification clearly clarifies that's not the
> intended result.
> 
> I would reword step 2 and the clarification as:
> 
> "Bind each ? placeholder with the value of the argument in the arguments
> array with the same position. (So the first ? placeholder is bound the
> first value in the arguments array, and generally the nth ? placeholder
> gets bound by the nth value in the arguments array.)
> By binding, the result of the query must be the same as if the arguments
> had been literally replaced on the sql string, although this later
> practice is not recommended because it may risk SQL injection attacks."
> 
> Using Bind for Replace makes it much more clear.

Done.

-- 
Ian Hickson               U+1047E                )\._.,--....,'``.    fL
http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'