Object Relational Membrane - News
posted by diedrich, Wed 24 May 2006 08:12:42 AM UTC
This vulnerability is not so much a fault of Postgres, but one of PHP's addslashes(), which will convert certain Unicode sequences to quotes, allowing to add arbitrary SQL to a Web-Request. It seems, orm2's quoting functions, which are based on string.replace(), are too primitive to be fooled by this. Also they operate on Python single byte strings only, which makes sure we're on the save side.
Cheers Diedrich
posted by diedrich, Thu 04 May 2006 12:09:07 PM UTC
This is the second alpha release of orm2. The core of orm is now basically feature complete. The user interface module is still at a design stage. I've completed the MySQL adapter and successfully run the regression tests on it. And comment or contribution is very welcome!
posted by diedrich, Fri 28 Apr 2006 10:29:53 AM UTC
Thanks for looking in! In the CVS repository you'll find a module called orm2. It is a complete rewrite of orm with many new ideas! I have no documentation except extensive (epydoc) comments and a couple of examples and regression tests. I hope you'll still be able to make head and feet of this... Please do not hesitate to contact me with any question you might have.
Powered by Savane 3.14-8aba.
Corresponding source code