Support for 'for' (loop) command in the SQL parser. about mirage HOT 6 OPEN

Thanks for your request.

Yes, I understand a necessity for FOR loop. But I have one question in your comment.

it's bound to only one parameter this is open to SQL Injection

What does it mean? I think it's safe to give the array which has one element to IN parameter. Are you describing about other case?

If there are any cases which cause SQL injection with /*var*/ (NOT /*$var*/), it's a bug of Mirage, so I'll fix it as soon as possible.

from mirage.

But I have one question in your comment.

it's bound to only one parameter this is open to SQL Injection

What does it mean? I think it's safe to give the array which has one element to IN parameter. Are you describing about other case?

An array with more than one element is the problem.

I think last time I've tried, with a Prepared Statement was possible to bind only one parameter, not a "variable sized one", i.e.

where something IN (?)

So since Mirage allows to "bind an array", it must concatenate the elements, and since it doesn't seems to use
http://code.google.com/p/owasp-esapi-java/ that's probably not SQL injection proof.

from mirage.

a Prepared Statement was possible to bind only one parameter, not a "variable sized one"

Yes, so Mirage expands array binding to the multiple placeholder.

where something IN /*array*/

to

where something IN (?, ?, ...)

See #1 (comment) to know how to bind array as IN parameter in Mirage:

from mirage.

Any news on the "loop" command support?

from mirage.

I subscribe to @hansgru 's request. A "for" loop would simplify quite a few scenarios.

tnx

from mirage.

+1

from mirage.