On Fri, Apr 6, 2012 at 10:43 PM, kromakey <recursive68@gmail.com> wrote:
Hi,
I've been looking at the DBTalk tests/examples and also at OpenDBX, and it looks like binds variables aren't supported in SQL statements and more importantly for myself when using them in procedures.
In Java's JDBC:
String sqlStmt = "SELECT * FROM employees where last_name=? and first_name like ?"; prepStmt = conn.prepareStatement(sqlStmt); prepStmt.setString(1, bindvarLastName); prepStmt.setString(2, bindvarFirstName); rs = prepStmt.executeQuery();
In Perl DBI you can do this when using Oracle PL/SQL, which allows you to get return values from the procedure using bind variables in this case $message and $status, when call a PL/SQL procedure:
# bind variable $message = undef; $status = undef;
# prepare query my $sth = $dbh->prepare( "BEGIN test.testProc(:status, $username,:message); END;" ); $sth->bind_param_inout(":status", \$status, 10); $sth->bind_param_inout(":l_message", \$message, 500);
# execute query $sth->execute;
It looks like this is a limitation of OpenDBX rather than DBXTalk,
Unfortunatly, yes, I think it is a limitation of OpenDBX. At least it was planned: "Prepared statement interface" in http://www.linuxnetworks.de/doc/index.php/OpenDBX/Future
but if it is the case it's a big omission when you compare it against other languages database interface APIs, such as Java's JDBC, Perl's DBI and Python cx_Oracle for example. This is also not so good from a security perspective as bind variables are one of the recommended defences against SQL injection attacks.
For that we have: http://www.linuxnetworks.de/doc/index.php/OpenDBX/C_API/odbx_escape
Am i correct in thinking this, or I have I missed something ?
Sorry for the bad news, but I think you are correct. -- Mariano http://marianopeck.wordpress.com