Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

How to query beans (aka where statements)? #24

Closed
igorgatis opened this issue Sep 16, 2016 · 5 comments
Closed

How to query beans (aka where statements)? #24

igorgatis opened this issue Sep 16, 2016 · 5 comments

Comments

@igorgatis
Copy link

Documentation says there are several ways of loading beans. I could only find 2: loadBean and getAllBeans.

How do I query beans?

@d-led
Copy link
Collaborator

d-led commented Sep 16, 2016

Please see the last comment in #23. If I'm not mistaken, there are no other query api at the moment.

@rtoepfer
Copy link
Contributor

rtoepfer commented Apr 13, 2017

I've submitted a pull request (#29) to that allows the following:

class ScandyHiberliteDatabase : public hiberlite::Database {
public:
  ScandyHiberliteDatabase() : hiberlite::Database() {}

  // we need to be able to specify constraints
  template<class T>
  std::vector<hiberlite::sqlid_t> getBeanIds(std::string where = "", std::string order = "") {
    return dbSelectIds(con, getClassName<T>(), where, order);
  }

  // we need to execute raw sql to add column constraints
  void dbExecQuery(std::string query) {
    hiberlite::Database::dbExecQuery(query);
  }

  // get underlying sqlite error messages
  std::string getErrorMsg() {
    return std::string(sqlite3_errmsg(con->getSQLite3Ptr()));
  }
};

@d-led
Copy link
Collaborator

d-led commented Jan 31, 2018

merged #29

@d-led d-led closed this as completed Jan 31, 2018
@OxMarco
Copy link

OxMarco commented Sep 27, 2018

It lacks a basic check on input, it is very unsafe and can lead to DB errors.
I suggest to restrict user input to a single search condition.

template<class C>
std::vector<sqlid_t> Database::getBeanIds(std::string column, std::string value, std::string order)
{
    std::string sqlQuery = "";
    
    if(column.size() > 0 && value.size() > 0)
        sqlQuery = column + " = '" + value + "'";
    
    return dbSelectIds(con, getClassName<C>(), sqlQuery, order);
}

@rtoepfer
Copy link
Contributor

Note the code above and the code you posted don't exist in the repository - only the changes that allowed the code above were merged. Its up to the app developer to handle parameter sanitization if even necessary (this is C++ not a web scripting language).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants