buggins / ddbc

DDBC is DB Connector for D language (similar to JDBC)
78 stars 45 forks source link

How to check if SQL request returned empty result #14

Closed bubnenkoff closed 8 years ago

bubnenkoff commented 8 years ago
string query_string = (`SELECT user, password FROM otest.myusers where user LIKE ` ~ `'%` ~ request["username"].to!string ~ `%';`);
        auto rs = db.stmt.executeQuery(query_string);

        string dbpassword;
        string dbuser;

        while (rs.next())
        {
            dbuser = rs.getString(1);
            dbpassword = rs.getString(2);
            writeln(dbuser);
            writeln("Place unreachable"); // if SQL result is empty

How I can check if SQL request returned empty result?

buggins commented 8 years ago

Btw, there might be sql injection. E.g. if username entered is ' or user LIKE ' all users will be returned. Use quoting of string before appending to query.