all messages for Emacs-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
From: Jean Louis <bugs@gnu.support>
To: help-gnu-emacs@gnu.org
Subject: Re: Emacs Modular Configuration: the preferable way.
Date: Tue, 22 Jun 2021 00:07:13 +0300	[thread overview]
Message-ID: <YND/gVHnfztABlqD@protected.localdomain> (raw)
In-Reply-To: <87zgvjcgh6.fsf@zoho.eu>

* Emanuel Berg via Users list for the GNU Emacs text editor <help-gnu-emacs@gnu.org> [2021-06-21 20:07]:
> > The language itself has evolved a lot since its beginnings
> > (to the better, IMO). But you still see extremely bad habits
> > "out there" which wouldn't be necessary these days --
> > because, well, they are "out there" (for example: assebling
> > SQL queries with sprintf [1]). They take a life of their own
> > :-)
> 
> If it is string to begin with and the end result is a string
> one should be able to use string functions to "assemble" it.

I am thinking how can I make it safer for SQL queries. It seem
not an easy task. Major updating function is using this:

(let* ((table "new")
       (column "new_name")
       (new-value "'Joe'")
       (id 1)
       (sql (format "UPDATE %s SET %s = %s WHERE %s_id = %s RETURNING %s_id" table column new-value table id table)))
  (message sql)
  (rcd-sql-first sql db)) ⇒ 1

Then I have to convert it to following by its meaning:

(let* ((table "new")
       (column "new_name")
       (new-value "'Joe'")
       (id 1)
       (parameters (list table column new-value id))
       (sql "UPDATE $1 SET $2 = $3 WHERE $1_id = $4 RETURNING $1_id"))
  (message sql)
  (rcd-sql-first sql db parameters))

But no, that does not work:

if: Wrong type argument: stringp, ("ERROR:  syntax error at or near \"$1\"
LINE 1: UPDATE $1 SET $2 = $3 WHERE $1_id = $4 RETURNING $1_id
               ^
" "42601")

As those paramters are probably converted to strings. Thus I
cannot avoid using the function `format' just everywhere, but I
can minimize it wherever there is possible danger for SQL
injection (though this below is not working):

(let* ((table "new")
       (column "new_name")
       (new-value "'Joe'")
       (id 1)
       (parameters (list new-value id))
       (sql (format "UPDATE %s SET %s = $1 WHERE %s_id = $2 RETURNING %s_id" table column table table)))
  (message sql)
  (rcd-sql-first sql db parameters))

Maybe solution would be to use `format' in steps, so that final
step can accept users' input.

Issue is not solved. First I have to contact developers of
`emacs-libpq' package to see if this is error, as it returns
string by supplying integer parameter:

This is not expected:

(pq:query db "SELECT $1" 100) ⇒ ("100")

While this is expected:

(pq:query db "SELECT $1" "100") ⇒ ("100")

So the issue is pending on Github:
https://github.com/anse1/emacs-libpq/issues/19

-- 
Jean

Take action in Free Software Foundation campaigns:
https://www.fsf.org/campaigns

In support of Richard M. Stallman
https://stallmansupport.org/



  parent reply	other threads:[~2021-06-21 21:07 UTC|newest]

Thread overview: 86+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-06-21  1:40 Emacs Modular Configuration: the preferable way Hongyi Zhao
2021-06-21  2:56 ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-21  6:40   ` Jean Louis
2021-06-21 16:31     ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-21 19:55       ` Jean Louis
2021-06-22  0:06         ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-21 10:14   ` Arthur Miller
2021-06-21 16:40     ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-21 18:25       ` [External] : " Drew Adams
2021-06-26  0:17         ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-26  0:31           ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-21 18:38       ` Arthur Miller
2021-06-22  0:03         ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-22  0:17           ` Jean Louis
2021-06-22  7:52           ` Arthur Miller
2021-06-26  6:58             ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-21 11:29   ` Eli Zaretskii
2021-06-21 12:45     ` Philip Kaludercic
2021-06-21 12:55       ` Eli Zaretskii
2021-06-21 13:59         ` [External] : " Drew Adams
2021-06-21 16:51           ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-21 18:08             ` Eli Zaretskii
2021-06-21 18:26             ` FW: " Drew Adams
2021-06-26  0:06               ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-21 14:11       ` tomas
2021-06-21 16:47         ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-21 18:06           ` Eli Zaretskii
2021-06-21 21:09             ` Jean Louis
2021-06-22 11:45               ` Eli Zaretskii
2021-06-22 12:29                 ` Jean Louis
2021-06-22 13:07                   ` Eli Zaretskii
2021-06-21 20:05           ` Stefan Monnier via Users list for the GNU Emacs text editor
2021-06-22  0:16             ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-21 21:07           ` Jean Louis [this message]
2021-06-22  0:33             ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-22  0:52               ` Printf and quoting in general, SQL injection in particular Jean Louis
2021-06-26  6:50                 ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-26  7:30                   ` Yuri Khan
2021-06-26  7:57                     ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-26  9:37                     ` tomas
2021-06-28  7:02                   ` Jean Louis
2021-07-06  2:12                     ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-07-06  2:46                       ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-21 20:36         ` Emacs Modular Configuration: the preferable way Jean Louis
2021-06-21 21:15           ` Printf and quoting in general, SQL injection in particular [was: Emacs Modular Configuration: the preferable way] tomas
2021-06-21 21:29             ` Jean Louis
2021-06-22  0:31               ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-22  0:47                 ` Jean Louis
2021-06-26  6:31                   ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-28  6:56                     ` Jean Louis
2021-07-06  1:57                       ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-07-06 20:04                         ` Jean Louis
2021-07-06 20:19                           ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-22  0:23             ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-22 12:12               ` Eli Zaretskii
2021-06-22 12:37                 ` Jean Louis
2021-06-22 13:10                   ` Eli Zaretskii
2021-06-22 15:45                     ` Jean Louis
2021-06-22 16:04                       ` Eli Zaretskii
2021-06-22 18:01                         ` Jean Louis
2021-06-22 18:25                           ` Eli Zaretskii
2021-06-26  6:46                           ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-26  7:15                             ` Eli Zaretskii
2021-06-28  7:04                               ` Jean Louis
2021-07-06  2:05                                 ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-07-06 20:09                                   ` Jean Louis
2021-07-06 20:23                                     ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-07-07  0:00                                       ` Jean Louis
2021-06-28  6:59                             ` Jean Louis
2021-07-06  2:02                               ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-07-06 20:06                                 ` Jean Louis
2021-07-06 20:20                                   ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-26  6:41                       ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-26  6:39                   ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-21 16:42       ` Emacs Modular Configuration: the preferable way Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-22 12:50       ` Lars Ingebrigtsen
2021-06-26  8:05         ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-21 20:02   ` Jean Louis
2021-06-22  0:11     ` Emanuel Berg via Users list for the GNU Emacs text editor
2021-06-22  0:19       ` Jean Louis
2021-06-21  6:37 ` Jean Louis
2021-06-21  7:00   ` Hongyi Zhao
2021-06-21 10:06     ` Arthur Miller
2021-06-21 10:26       ` Hongyi Zhao
2021-06-21 11:10         ` Arthur Miller
2021-06-23  2:17           ` Hongyi Zhao

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YND/gVHnfztABlqD@protected.localdomain \
    --to=bugs@gnu.support \
    --cc=help-gnu-emacs@gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/emacs.git
	https://git.savannah.gnu.org/cgit/emacs/org-mode.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.