Back in C++/C#/Java world a good solution is the RAII pattern - combining validation/conversion with object construction; although it would be nicer if it can be written declaratively, something akin to XML Schema types. <br>
<br>For me - type declarations should help one separate validation/cast/error routines from the main responsibility of the procedures, and if compiler can then take advantage of the info to perform optimizations, all the better.
<br><br>yinso <br><br><div><span class="gmail_quote">On 5/31/07, <b class="gmail_sendername">Robby Findler</b> <<a href="mailto:robby@cs.uchicago.edu">robby@cs.uchicago.edu</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
There is a standard technique the MLers use for this; they encapsulate<br>the SQL command in an abstract type and only allow operations that<br>make sense for constructing the values. Of course, if you are getting<br>the SQL from a web page, you have to still be a little bit careful on
<br>how you call the parser, but probably you can some leverage out of the<br>data abstraction.<br><br>Robby<br><br>On 5/31/07, Noel Welsh <<a href="mailto:noelwelsh@gmail.com">noelwelsh@gmail.com</a>> wrote:<br>> On 5/31/07, Richard Cobbe <
<a href="mailto:cobbe@ccs.neu.edu">cobbe@ccs.neu.edu</a>> wrote:<br>> > Are there static type systems that can protect against, e.g., SQL<br>> > injection?<br>><br>> Not that I know of. However you could define your SQL library using,
<br>> say, a 'validated' type instead of strings and then your type system<br>> will prevent you from using string that haven't been validated. Of<br>> course you can do this with dynamic checks as well, with the usual
<br>> tradeoffs.<br>><br>> Joel on Software has a post justifying the use of Hungarian notation<br>> to implementation a poor man's type system for a similar use.<br>><br>> N.<br>> _________________________________________________
<br>> For list-related administrative tasks:<br>> <a href="http://list.cs.brown.edu/mailman/listinfo/plt-scheme">http://list.cs.brown.edu/mailman/listinfo/plt-scheme</a><br>><br>_________________________________________________
<br> For list-related administrative tasks:<br> <a href="http://list.cs.brown.edu/mailman/listinfo/plt-scheme">http://list.cs.brown.edu/mailman/listinfo/plt-scheme</a><br></blockquote></div><br>