Hi,

I've been looking at the DBTalk tests/examples and also at OpenDBX,
and it looks like binds variables aren't supported in SQL statements
and more importantly for myself when using them in procedures.

In Java's JDBC:

� � � � � � � � � � � �String sqlStmt = "SELECT * FROM employees where last_name=? and
first_name like ?";
� � � � � � � � � � � �prepStmt = conn.prepareStatement(sqlStmt);
� � � � � � � � � � � �prepStmt.setString(1, bindvarLastName);
� � � � � � � � � � � �prepStmt.setString(2, bindvarFirstName);
� � � � � � � � � � � �rs = prepStmt.executeQuery();

In Perl DBI you can do this when using Oracle PL/SQL, which allows you
to get return values from the procedure using bind variables in this
case $message and $status, when call a PL/SQL procedure:

�# bind variable
�$message = undef;
�$status = undef;

�# prepare query
�my $sth = $dbh->prepare(
� � � � � � � � � �"BEGIN
� � � � � � � � � � � test.testProc(:status, $username,:message);
� � � � � � � � � �END;"
� � � � � �);
�$sth->bind_param_inout(":status", \$status, 10);
�$sth->bind_param_inout(":l_message", \$message, 500);

�# execute query
� $sth->execute;


It looks like this is a limitation of OpenDBX rather than DBXTalk,

but
if it is the case it's a big omission when you compare it against
other languages database interface APIs, such as Java's JDBC, Perl's
DBI and Python cx_Oracle for example. �This is also not so good from a
security perspective as bind variables are one of the recommended
defences against SQL injection attacks.

Am i correct in thinking this, or I have I missed something ?