Just another update

Task/Parametrized-SQL-statement/00DESCRIPTION

@@ -1,7 +1,8 @@
-Parameterized SQL statements are an easy way to avoid [[wp:SQL injection|SQL injection]] attacks. SQL drivers and libraries will automatically "sanitize" input to parameterized SQL statements to avoid these catastrophic database attacks.
+Parameterized SQL statements are an easy way to avoid [[wp:SQL injection|SQL injection]] attacks. SQL drivers and libraries will automatically "sanitize" input to parameterized SQL statements to avoid these catastrophic database attacks. Second, parameterized SQL performs better. A lot better.
 
 Using a SQL update statement like this one (spacing is optional):
 <lang sql>UPDATE players
    SET name = 'Smith, Steve', score = 42, active = true
-   WHERE jerseyNum = 99</lang>
-show how to make a parameterized SQL statement, set the parameters to the values given above, and execute the statement.
+   WHERE jerseyNum = 99</lang>show how to make a parameterized SQL statement, set the parameters to the values given above, and execute the statement.
+
+<blockquote cite="http://blog.codinghorror.com/give-me-parameterized-sql-or-give-me-death/">Non-parameterized SQL is the GoTo statement of database programming. Don't do it, and make sure your coworkers don't either.</blockquote>

Task/Parametrized-SQL-statement/Go/parametrized-sql-statement.go

@@ -0,0 +1,33 @@
+package main
+
+import (
+    "database/sql"
+    "fmt"
+
+    _ "github.com/mattn/go-sqlite3"
+)
+
+func main() {
+    db, _ := sql.Open("sqlite3", "rc.db")
+    defer db.Close()
+    db.Exec(`create table players (name, score, active, jerseyNum)`)
+    db.Exec(`insert into players values ("",0,0,"99")`)
+    db.Exec(`insert into players values ("",0,0,"100")`)
+
+    // Parameterized
+    db.Exec(`update players set name=?, score=?, active=? where jerseyNum=?`,
+        "Smith, Steve", 42, true, "99")
+
+    rows, _ := db.Query("select * from players")
+    var (
+        name      string
+        score     int
+        active    bool
+        jerseyNum string
+    )
+    for rows.Next() {
+        rows.Scan(&name, &score, &active, &jerseyNum)
+        fmt.Printf("%3s %12s %3d %t\n", jerseyNum, name, score, active)
+    }
+    rows.Close()
+}

Task/Parametrized-SQL-statement/Seed7/parametrized-sql-statement.seed7

@@ -0,0 +1,32 @@
+$ include "seed7_05.s7i";
+  include "sql_base.s7i";
+
+const proc: main is func
+  local
+    var database: testDb is database.value;
+    var sqlStatement: statement is sqlStatement.value;
+    var string: name is "Smith, Steve";
+  begin
+    testDb := openDatabase(DB_SQLITE, "test", "test", "test");
+    execute(testDb, "create table players (name CHAR(32), score INTEGER, active CHAR, jerseyNum INTEGER)");
+    execute(testDb, "insert into players values ('Jones, Bob',0,0,99)");
+    execute(testDb, "insert into players values ('Jesten, Jim',0,0,100)");
+    execute(testDb, "insert into players values ('Jello, Frank',0,0,101)");
+    statement := prepare(testDb, "update players set name = ?, score = ?, active = ? \
+                                 \where jerseyNum = ?");
+    bind(statement, 1, name);
+    bind(statement, 2, 42);
+    bind(statement, 3, TRUE);
+    bind(statement, 4, 99);
+    execute(statement);
+    statement := prepare(testDb, "select * from players");
+    execute(statement);
+    while fetch(statement) do
+      writeln(column(statement, 1, string) <& " " <&
+              column(statement, 2, integer) <& " " <&
+              column(statement, 3, boolean) <& " " <&
+              column(statement, 4, integer));
+    end while;
+    execute(testDb, "drop table players");
+    close(testDb);
+  end func;