On Fri, Apr 6, 2012 at 10:43 PM, kromakey <recursive68@gmail.com> wrote:

Hi,

I've been looking at the DBTalk tests/examples and also at OpenDBX, and it looks like binds variables aren't supported in SQL statements and more importantly for myself when using them in procedures.

In Java's JDBC:

String sqlStmt = "SELECT * FROM employees where last_name=? and first_name like ?"; prepStmt = conn.prepareStatement(sqlStmt); prepStmt.setString(1, bindvarLastName); prepStmt.setString(2, bindvarFirstName); rs = prepStmt.executeQuery();

In Perl DBI you can do this when using Oracle PL/SQL, which allows you to get return values from the procedure using bind variables in this case $message and $status, when call a PL/SQL procedure:

# bind variable $message = undef; $status = undef;

# prepare query my $sth = $dbh->prepare( "BEGIN test.testProc(:status, $username,:message); END;" ); $sth->bind_param_inout(":status", \$status, 10); $sth->bind_param_inout(":l_message", \$message, 500);

# execute query $sth->execute;

It looks like this is a limitation of OpenDBX rather than DBXTalk,

Unfortunatly, yes, I think it is a limitation of OpenDBX. At least it was planned: "Prepared statement interface" in http://www.linuxnetworks.de/doc/index.php/OpenDBX/Future

but if it is the case it's a big omission when you compare it against other languages database interface APIs, such as Java's JDBC, Perl's DBI and Python cx_Oracle for example. This is also not so good from a security perspective as bind variables are one of the recommended defences against SQL injection attacks.

For that we have: http://www.linuxnetworks.de/doc/index.php/OpenDBX/C_API/odbx_escape

Am i correct in thinking this, or I have I missed something ?

Sorry for the bad news, but I think you are correct. -- Mariano http://marianopeck.wordpress.com