diff -r d4c2968a391f -r d7ae02390fac relpipe-data/examples-guile-parametrized-queries.xml --- a/relpipe-data/examples-guile-parametrized-queries.xml Sat Sep 12 13:20:21 2020 +0200 +++ b/relpipe-data/examples-guile-parametrized-queries.xml Fri Sep 25 14:38:24 2020 +0200 @@ -2,7 +2,7 @@ xmlns="https://trac.frantovo.cz/xml-web-generator/wiki/xmlns/strana" xmlns:m="https://trac.frantovo.cz/xml-web-generator/wiki/xmlns/makro"> - Parametrized queries with Guile + Parametrized queries with Scheme passing input parameters and avoiding code-injections 01600 @@ -20,7 +20,7 @@

- But it is fundamentally wrong. The input parameter is blindly pasted in middle of the Guile code. + But it is fundamentally wrong. The input parameter is blindly pasted in middle of the Scheme code. So if we call e.g. fstab-where-type 'ext4"', it crashes terribly. Do you remember SQL injections in your first PHP scripts when you were 14? Do not do it again!

- The relpipe-tr-guile tool has a safe way for passing parameters from the outside. And such parameters are even strongly typed. + The relpipe-tr-scheme tool has a safe way for passing parameters from the outside. And such parameters are even strongly typed. So this is, how our program should be written: