Re: Standard DBI Proposal

Darren New wrote:
It would be nice, but how do you handle code like
if ("" != $_GET['name'])
$sql .= "WHERE name like '" . esc($_GET['name']) . "%' AND ";
(Yes, it's PHP. Deal. :-)

I often do this sort of thing with a dozen different form fields,
building up a query clause by clause. If I had only prepared statements,
would I need 2^N statements?

No, since the interface layer should be hiding all that stuff from
you, and you'd just be writing:

if {$GET(name) ne ""} {
# I can't remember right now if SQLite handles array vars
set paramName $GET(name)
append sql {WHERE name LIKE '$paramName%' AND }
}

Yes, this is the SQLite approach. It gets it *right*.

Donal.

.

Relevant Pages

  • Re: Standard DBI Proposal
    ... I often do this sort of thing with a dozen different form fields, building up a query clause by clause. ... If I had only prepared statements, ...
    (comp.lang.tcl)
  • Re: Standard DBI Proposal
    ... building up a query clause by clause. ... If I had only prepared statements, ... you discover two months into a project that a title field needs to be ... validation, including length checking, prior to insert, right?) ...
    (comp.lang.tcl)
  • Re: Standard DBI Proposal
    ... building up a query clause by clause. ... since the interface layer should be hiding all that stuff from ... this is the SQLite approach. ... brush up on SQL Injection attacks, ...
    (comp.lang.tcl)