4 ms·

https://github.com/ashok-khanna/common-lisp-by-example/blob/41544bd5838a032964be5472812ad6d475f5ca19/example-server/blog-server.lisp#L27 https://github.com/asho

by MawKKe 6y ago

https://github.com/ashok-khanna/common-lisp-by-example/blob/41544bd5838a032964be5472812ad6d475f5ca19/example-server/blog-server.lisp#L27 https://github.com/ashok-khanna/common-lisp-by-example/blob/... Formatting queries like this is not a good idea at all. See: https://en.wikipedia.org/wiki/SQL_injection https://en.wikipedia.org/wiki/SQL_injection

fidesomnes 6y ago
is there a better method for lisp?
- hashkb 6y ago
  Something like https://github.com/fukamachi/sxql https://github.com/fukamachi/sxql
- abhinav22 6y ago
  The issue with my code is that somebody can put in arbitrary SQL queries within the data field (I think - not sure if it is 100% possible because their data would be enclosed within the programs SQL query, which may break their attempts) Best way around it is to put in checks to prevent the code from being anything nefarious. I’ll have a think and figure out what’s the best way of doing this, but I assume not constructing the sql strings from scratch but rather using postmodern’s API (postmodern is Common Lisp’s excellent interface to PostgreSQL) makes sense, or the alternate solution recommended in the other reply to your post.
  - stevelosh 6y ago
    Postmodern can do the right thing if you use prepared queries. See `defprepared`.
    - abhinav22 6y ago
      Thanks! I will use that
      - abhinav22 6y ago
        For those interested, refer to https://sites.google.com/site/sabraonthehill/postmodern-examples/postmodern-parametized-statements https://sites.google.com/site/sabraonthehill/postmodern-exam... Thanks also to kagevf on #lisp irc channel for his help here
abhinav22 6y ago
That’s a good point. I will update the code to prevent any potential SQL injections so that others follow the right practice. Very nice catch! Thank you very much.