A follow-on to: http://drupal.org/node/167284

the lack of a simple placeholder for multi-int lists in DB queries has led to insecure queries like "WHERE nid IN (%s)"

Attached script can be run from the command line to compare the speed of various methods of handling this (note edit line ~75 to try arg arrays of different sizes). What's interesting is that creating a set of %d placeholders is a loser from a speed standpoint, and probably also in terms of convenience (speed test results follow).

Comments

pwolanin’s picture

StatusFileSize
new1.83 KB

results of speed comparisons attached. The bottom line - using implode(',', array_fill(0, count($args), '%d')) is not very good compared to having a placeholder that can handle multi-int lists. Interestingly, we could use str_tok() to give added flexibility (if desired) with similar or better performance than just using explode().

pwolanin’s picture

Status: Active » Needs review
StatusFileSize
new1.24 KB

since '%dd' won't work (the 1st 2 chars are matched first), how about '%D' ?

pwolanin’s picture

This technique could, potentially, be extended to strings, but it's harder to get right since we need to be sure each string end up wrapped in single quotes.

pwolanin’s picture

Title: Create multi-int query placeholder or helper function for D6 » Create multi-int, multi-string query placeholders for D6
StatusFileSize
new1.59 KB

here's a patch that does the same thing for Strings - Moshe says this would be useful for Views, OG, etc.

Note usage is like:

db_query("SELECT * FROM {node} WHERE type IN('%S')", implode(',', $args)));

note the wrapping single quotes are required as with %s - I think this makes sense for consistency.

(note: it would be better in terms of security to make %s and this add the outer quotes automatically, but that would require changing a lot of core code - should it be proposed?).

pwolanin’s picture

StatusFileSize
new3.14 KB

Heres a test script - again there results are similar to above. For a single argument, it's better to use '%s', but for ~3 or more, the str_tok() or explode() is faster.

For example, in a typical run with PHP 4.4.7 I got:

t1: 20.985004663467, t2: 14.322191238403, t3: 14.432777166367 where num args is 11
dries’s picture

The db_query() syntax is likely to completely change in D7.

pwolanin’s picture

@Dries - yes, I expect so. But does that mean this patch is going to cause problems then? Or that it would just be a short-lived changed to the API, or that we'd be better off just implementing a placeholder helper function?

moshe weitzman’s picture

subscribe. lets do s simple function, no?

dave reid’s picture

Status: Needs review » Closed (won't fix)

Since this is not likely to land in D6 anymore since it has been out so long, I am marking this won't fix.