Simple and safe SQL queries with c++ templates

Most software applications use a relational database for data management and storage. Interaction with such a database is often done by letting the program construct strings with valid SQL statements, which are then sent for execution to the database engine. The fact that these statements are only checked for correctness at runtime is a source for many potential problems such as type and syntax errors and vulnerability to injection attacks. The ARARAT system presented here offers a method for dealing with these predicaments, by coercing the host C++ compiler to do the necessary checks of the generated strings. A library of templates and preprocessor directives effectively extends C++ with a little language representing an augmented relational algebra formalism. Type checking of this language extension, carried out by our template library, assures, at compile-time, the correctness and safety of the generated SQL strings. That is to say that all SQL statements constructed by the system ...

• Type: Conference
• Year: 2007
• Where: GPCE
• Authors: Joseph Gil, Keren Lenz
• Keywords: Artificial Intelligence, Database, GPCE 2007, Injection Attacks, SQL Statements