bigpresh/Dancer-Plugin-Database — Issue #17: Scalar refs for calling SQL functions avoiding quoting/placeholders
Author: bigpresh
Created: 2011-12-06 10:12:33+00:00
State: open
Labels: wishlist

Currently, all values passed to `quick_insert` / `quick_update` are handled using placeholders, which means you can't call SQL functions - for instance:

database->quick_insert('log', { datetime => "DATETIME('now')", msg => $msg });

... will not work, because you can't use function calls as parameter values.

It should be possible to provide scalar refs as values, to indicate that the value should be used in the query verbatim, for instance:

database->quick_insert('log', { datetime => \"DATETIME('now')", msg => $msg });

It should of course be clearly documented that this means the value you pass is used verbatim, so incorrect use of it can lead to SQL injection vulnerabilities - for example:

# Horribly wrong:
database->quick_insert('log', { foo => \$bar });

... if `$bar` came from untrusted input, you have an SQL injection vulnerability right there.

The other alternative implementation would be passing a hashref containing the value and a `quote` option, e.g.:

database->quick_insert('foo', { datetime => { value => "DATETIME('now')", quote => 0 } ... });

A simple scalar reference is probably easier, though.