Open MKuckert opened 9 years ago
This has been causing me great grief for the past 4 hours. Given that it handles class structures and parsing out properties, the fact that it doesn't escape them is just silly.
Yeah this sounds good to have!
@AlexKven because this library uses parameterization, it doesn't need to escape arguments.
The binding mechanism of the extension is pretty nice and convenient, but sometimes it's easier to build a large query by concatenating many different strings. This makes the code vulnerable for SQL Injections by breaking out of quotes string parts.
The sqlite Library itself provides a method
sqlite3_mprintf
to quote a string for safe query inclusion (usage ismySafeString = sqlite3_mprintf('%q', myUnsafeString);
). Is there any possibility to include thesqlite3_mprintf
-function or a simplerEscape
-method with direct usage of the function into the library?