🕸Fergus Duniho wrote on Tue, Apr 24, 2018 07:16 PM UTC:
I found a call to table_rows() which looked like this:
table_rows("Person", "1", "1", "ORDER BY LastName, FirstName, PersonID");
The purpose of the "1","1", was to include 1=1 in the SQL, which would return the entire Person table. This was a kludge for using table_rows() with a vacuous WHERE condition that would return everything. It had to be done this way, because the second and third arguments used to be reserved for the column and value that specified the WHERE condition for the search. Since I changed the function to use a variable number of arguments, this is no longer needed, and this will return the same result:
table_rows("Person", "ORDER BY LastName, FirstName, PersonID");
Furthermore, the error correction I added today with the valid_column_name() function prevents the original kludge from working. So, wherever a kludge like this has been used to return a full table, it can and should now be deleted.
I found a call to table_rows() which looked like this:
The purpose of the "1","1", was to include 1=1 in the SQL, which would return the entire Person table. This was a kludge for using table_rows() with a vacuous WHERE condition that would return everything. It had to be done this way, because the second and third arguments used to be reserved for the column and value that specified the WHERE condition for the search. Since I changed the function to use a variable number of arguments, this is no longer needed, and this will return the same result:
Furthermore, the error correction I added today with the valid_column_name() function prevents the original kludge from working. So, wherever a kludge like this has been used to return a full table, it can and should now be deleted.