Re: SQL parsing irregularity when using SQL reader syntax.

> Platform: Postgres/Linux
>
> Reproduction:
>
> (let ((my-string (make-string 1 :initial-element #\Nul)))
>    (select [foo] :from [bar] :where [= [foo] my-string]))
>
> You should get an error about an unterminated string constant, caused by the nul
> character eventually being treated as a C-string terminating nul. Discovered by
> a hacker who was trying to SQL-inject me.

Ouch, so CLSQL doesn't use placeholders for variable contents?

Do all supported databases support placeholders, so that this could be done generally?


Regards,

Phil