X-Git-Url: http://git.shadowcat.co.uk/gitweb/gitweb.cgi?a=blobdiff_plain;f=lib%2FDBIx%2FClass%2FStorage%2FDBI%2FNoBindVars.pm;h=c3ba153be1a91417d19afd3f0983765fa1a27f55;hb=28cea3aa579791963ea117bdbfdbd4ee3e948555;hp=ea44fc49d0d7b5b48300dcb0107c55c87dc28af2;hpb=efa934d7d431f0d217eb527d8da144cbeb81c6ec;p=dbsrgits%2FDBIx-Class-Historic.git diff --git a/lib/DBIx/Class/Storage/DBI/NoBindVars.pm b/lib/DBIx/Class/Storage/DBI/NoBindVars.pm index ea44fc4..c3ba153 100644 --- a/lib/DBIx/Class/Storage/DBI/NoBindVars.pm +++ b/lib/DBIx/Class/Storage/DBI/NoBindVars.pm @@ -4,6 +4,7 @@ use strict; use warnings; use base 'DBIx::Class::Storage::DBI'; +use mro 'c3'; =head1 NAME @@ -39,7 +40,7 @@ Manually subs in the values for the usual C placeholders. sub _prep_for_execute { my $self = shift; - my ($op, $extra_bind, $ident) = @_; + my ($op, $extra_bind, $ident, $args) = @_; my ($sql, $bind) = $self->next::method(@_); @@ -48,15 +49,20 @@ sub _prep_for_execute { my @sql_part = split /\?/, $sql; my $new_sql; + my $col_info = $self->_resolve_column_info($ident, [ map $_->[0], @$bind ]); + foreach my $bound (@$bind) { my $col = shift @$bound; - my $datatype = 'FIXME!!!'; + + my $datatype = $col_info->{$col}{data_type}; + foreach my $data (@$bound) { - if(ref $data) { - $data = ''.$data; - } - $data = $self->_dbh->quote($data) if $self->should_quote_data_type($datatype, $data); - $new_sql .= shift(@sql_part) . $data; + $data = ''.$data if ref $data; + + $data = $self->_dbh->quote($data) + if $self->should_quote_value($datatype, $data); + + $new_sql .= shift(@sql_part) . $data; } } $new_sql .= join '', @sql_part; @@ -64,8 +70,8 @@ sub _prep_for_execute { return ($new_sql, []); } -=head2 should_quote_data_type - +=head2 should_quote_value + This method is called by L for every column in order to determine if its value should be quoted or not. The arguments are the current column data type and the actual bind value. The return @@ -73,15 +79,15 @@ value is interpreted as: true - do quote, false - do not quote. You should override this in you Storage::DBI:: subclass, if your RDBMS does not like quotes around certain datatypes (e.g. Sybase and integer columns). The default method always returns true (do quote). - - WARNING!!! - + + WARNING!!! + Always validate that the bind-value is valid for the current datatype. Otherwise you may very well open the door to SQL injection attacks. - -=cut - -sub should_quote_data_type { 1 } + +=cut + +sub should_quote_value { 1 } =head1 AUTHORS