[R-sig-DB] Parameterised queries

[Hadley Wickham]

>> It gives a new attack vector - to introduce additional data into the
>> database, you just need to figure out how to turn a length 1 vector in
>> to a length 2 vector.
>>
>> It's dangerous in the same way that allowing dbGetQuery() to execute
>> multiple queries is dangerous.
>
> I'd rather hope that if it were a case that mattered, the user would not
> rely on the api as a substitute for appropriate checks.

I think the API should be as safe as possible by default, and
sacrificing safety for speed should only be done explicitly when the
user asks for it.

Hadley

-- 
http://had.co.nz/