Bugs: Browse | Submit New | Admin

[#27121] dbd-pg-0.3.8 "pg_native_binding=false" support incorrect, incomplete

Date:
2009-09-17 04:58
Priority:
3
Submitted By:
Mike Pomraning (pilcrow)
Assigned To:
Nobody (None)
Category:
None
State:
Open
Summary:
dbd-pg-0.3.8 "pg_native_binding=false" support incorrect, incomplete

Detailed description
pg_native_binding support is limited to only those data types whose representation requires no quoting (e.g., NUMERICs).
Strings, for example, are interpolated as-is with no quoting/escaping, meaning they are taken to be database object
identifiers (like table or view names).

See the attached script for demonstration:

  $ ruby pg_native_binding.rb dbi:Pg:postgres $PG_USER $PG_PASS

Given that pg_native_binding=true is the default, and that even string binding doesn't work, I cannot believe that
pg_native_binding=false is widely used if at all.  Recommend dropping support entirely.

(Interestingly, TestDbdPostgres#test_binding (testdbipg.rb) passes tests because it attempts to non-natively bind
"NULL", becoming SQL NULL, and 19, correctly interpolated as a SQL literal.  The first assert_raises block
raises an exception on the prepare() and never reaches the execute(), where binding would take place, since PG won't
let you put a placeholder in an IS NULL / IS NOT NULL clause.)

Add A Comment: Notepad

Please login


Followup

No Followups Have Been Posted

Attached Files:

Name Description Download
No Files Currently Attached

Changes:

No Changes Have Been Made to This Item