pg_native_binding support is limited to only those data types whose representation requires no quoting (e.g., NUMERICs).
Strings, for example, are interpolated as-is with no quoting/escaping, meaning they are taken to be database object
identifiers (like table or view names).
See the attached script for demonstration:
$ ruby pg_native_binding.rb dbi:Pg:postgres $PG_USER $PG_PASS
Given that pg_native_binding=true is the default, and that even string binding doesn't work, I cannot believe that
pg_native_binding=false is widely used if at all. Recommend dropping support entirely.
(Interestingly, TestDbdPostgres#test_binding (testdbipg.rb) passes tests because it attempts to non-natively bind
"NULL", becoming SQL NULL, and 19, correctly interpolated as a SQL literal. The first assert_raises block
raises an exception on the prepare() and never reaches the execute(), where binding would take place, since PG won't
let you put a placeholder in an IS NULL / IS NOT NULL clause.)
|