Skip to content

Use parameterized queries in SQL connectors #983

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
4 tasks
bajtos opened this issue Jan 9, 2015 · 1 comment
Closed
4 tasks

Use parameterized queries in SQL connectors #983

bajtos opened this issue Jan 9, 2015 · 1 comment
Assignees
@raymondfeng

Comments

@bajtos
Copy link
Member

bajtos commented Jan 9, 2015

We should use parameterized SQL commands instead of string concatenation in all our SQL-based connectors.

Advantages:

  • No space for introducing SQL injection vulnerabilities. All user-provided values are always encoded by the SQL engine.
  • Parameterized SQL queries have significantly better performance, as the same querying plan can be used for all queries independently of parameter values. For queries built manualy via string concatenation, at least some SQL servers (MS SQL, IIRC) will build a new querying plan for each statement.

Connectors to fix:

  • loopback-connector-mysql
  • loopback-connector-postgresql
  • loopback-connector-oracle
  • loopback-connector-mssql
This was referenced Jan 9, 2015
Merged
Merged
Merged
@raymondfeng raymondfeng removed the #plan label Jan 26, 2015
@raymondfeng
Copy link
Member

The newly released 2.x connectors use parameterized SQL.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@raymondfeng raymondfeng

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@raymondfeng @bajtos @chandadharap