[Full-disclosure] When standards attack...

[Florian Weimer]

* H. D. Moore:

> The WebKit folks just added client-side SQL database support:
>  
> http://webkit.org/blog/126/webkit-does-html5-client-side-database-storage/
> http://glazkov.com/blog/html5-gears-wrapper/
>
> In addition to all of the existing attacks through a web browser, we can 
> now take into account SQLite vulnerabilities and client-side SQL 
> injection issues as well.

Interesting.  SQLite is a great piece of software, but it's not very
close to SQL, viz:

sqlite> SELECT 1 = '1';
0
sqlite> 

I wonder how the WebKit folks will bridge this gap, or if the people
behind HTML5 will standardize on whatever SQLite implements.

I'm also a bit surprised that the Javascript folks are suddenly expected
to write their programs in continuation-passing style, without much
syntactic support from the language.  It's like pre-generics Java
typing, but this time for flow control constructs.  Oh well.

> ...because letting developers choose to bind their query parameters has 
> worked so well before ;-)

What's the alternative?  A combinator library?  A language extension
that only permits static query strings?  String interpolation as
structured objects?  Most approaches require a new Ecmascript revision.