<stránka
	xmlns="https://trac.frantovo.cz/xml-web-generator/wiki/xmlns/strana"
	xmlns:m="https://trac.frantovo.cz/xml-web-generator/wiki/xmlns/makro">
	
	<nadpis>Parametrized queries with Scheme</nadpis>
	<perex>passing input parameters and avoiding code-injections</perex>
	<m:pořadí-příkladu>01600</m:pořadí-příkladu>

	<text xmlns="http://www.w3.org/1999/xhtml">
		
		<p>
			<m:name/> are not only for ad-hoc commands but – they could (and probably often should) be used for creating reusable programs.
			Such programs are once written, stored in a shell script or shell function or alias and then called many times.
		</p>
		
		<p>
			For example, we need a script which prints records from our <code>fstab</code> that have given filesystem type.
			We could do it this way:
		</p>
		
		<m:pre jazyk="bash"><![CDATA[fstab-where-type() {
	relpipe-in-fstab \
		| relpipe-tr-scheme \
			--relation fstab \
			--where '(string= $type "'$1'")' \
		| relpipe-out-tabular;
}]]></m:pre>

		<p>It seems working – e.g. if we call <code>fstab-where-type btrfs</code>, we get:</p>
		
		<m:pre jazyk="text"><![CDATA[fstab:
 ╭─────────────────┬──────────────────────────────────────┬──────────────────────┬───────────────┬──────────────────┬────────────────┬────────────────╮
 │ scheme (string) │ device                      (string) │ mount_point (string) │ type (string) │ options (string) │ dump (integer) │ pass (integer) │
 ├─────────────────┼──────────────────────────────────────┼──────────────────────┼───────────────┼──────────────────┼────────────────┼────────────────┤
 │ UUID            │ a2b5f230-a795-4f6f-a39b-9b57686c86d5 │ /home                │ btrfs         │ relatime         │              0 │              2 │
 ╰─────────────────┴──────────────────────────────────────┴──────────────────────┴───────────────┴──────────────────┴────────────────┴────────────────╯
Record count: 1]]></m:pre>
		
		<p>
			But it is fundamentally wrong. The input parameter is blindly pasted in middle of the Scheme code.
			So if we call e.g. <code>fstab-where-type 'ext4"'</code>, it crashes terribly.
			Do you remember SQL injections in your first PHP scripts when you were 14?
			Do not do it again!
		</p>
		
		<p>
			The <code>relpipe-tr-scheme</code> tool has a safe way for passing parameters from the outside. And such parameters are even strongly typed.
			So this is, how our program should be written:
		</p>

		<m:pre jazyk="bash"><![CDATA[fstab-where-type() {
	relpipe-in-fstab \
		| relpipe-tr-scheme \
			--relation fstab \
			--define 'myRequestedType' string "$1" \
			--where '(string= $type myRequestedType)' \
		| relpipe-out-tabular;
}]]></m:pre>

		<p>
			So when we call <code>fstab-where-type 'ext4"'</code> again, there is no crash, no code-injection.
			Just empty relation is returned because there is no record <code>WHERE type = 'ext4"'</code> (said in SQL words).
		</p>
		
		<p>
			Now it is like we do a parametrized query in SQL:
		</p>
		
		<m:pre jazyk="sql"><![CDATA[SELECT * FROM fstab WHERE type = :myRequestedType;]]></m:pre>

		<p>
			And bind the <code>myRequestedType</code> parameter.
		</p>
		
		
	</text>

</stránka>