[Gambas-user] Database and SQL code injection

[ron]

On Thursday 13 September 2007 23:48, Benoit Minisini wrote:
> Well, back to Gambas now. I want to go further, by simply rejecting any call 
> to Exec(), Find() or Delete(), if the first argument includes some quoting 
> characters.
> 
> This way, you will be compelled to use the quoting arguments.
> 
> What do you think about that?
> 
> -- 
> Benoit Minisini
> 

Proposal is not bad but I prefer a way to bypass all gambas mangeling for 
using DB.Exec("select concat("today=",`age`,now()) as `age` from `tblBenoit`;")