This document proposes that dynamic parameters be added to the DB Data Source Asset. Currently, the query specified in the Data Source Asset can only use static values in the WHERE / HAVING SQL clause. Proposed changes will allow these values to be supplied to this asset via the HTTP Request parameters (POST or GET). This will make the asset more dynamic and reduce the number of assets required because this asset will represent many similar queries instead of just one.
Status: Draft
Key: draft -> approved proposal -> scheduled -> in development -> in testing -> complete -> released
This feature is not scheduled for development
Planned Release Version: 3.10.0 RC1
Data Source asset represents one query from a Database and provides an interface to build this query. Currently it is able to serve queries like 'Get names and ids of all users with balance below 10 dollars' or 'Get name, id and price of products added on the 1st of March'. Once set up, the Asset will always return the results of this query. The only time the set of results produced by this asset will change is when the contents of the queried database change.
In order to get all users whose balance is below 100 dollars it would be required to create a new Data Source asset and specify the query similar to the above example only it will have 100 instead of 10 in the WHERE clause. Creating copies of assets quickly becomes inconvenient if many variations of the same query are required and/or when there is a need to use the same formatting to display results that come from these different Data Source assets (i.e. an Asset Listing).
It seems logical to allow the query to obtain the parameter dynamically instead of always relying on the static value. So this document proposes the introduction of dynamic parameters to Data Source assets which can be used in both manually specified queries and those constructed using the Query Builder GUI.
%%
PARAMETER_NAME_LOWERCASE is the name of the Request variable as specified in the 'Parameter Map' interface in lower case letters.
% is a special SQL character used as a wildcard in regular expressions. Two percent signs %% are used for keywords as opposed to the matrix standard one %. This is done to distinguish LIKE queries from keywords. I.e. % this% and %%. %%%% means that keyword is used inside the LIKE construct with wildcards around it.
These keywords have to be usable in any SQL query, even with the LIKE statement and percent signs.Manual query editor should receive a dropdown box with each dynamic parameter available. The name displayed in the box is the name specified in the parameter map interface. When selected, the keyword will be added into the editor field at the current cursor location.
On the query builder interface, a dropdown should be present next to each value input box in the 'WHERE/HAVING' clause section. Currently existent value input box shold be there as well. When both the keyword and value are specified, the static value is used as the default in case the dynamic parameter is not supplied at run-time.
All dynamic parameters default to empty strings which doesn't break SQL, but may cause unexpected behaviour. A keyword in the query, which does not have a corresponding dynamic parameter defined is replaced with an empty string. If an input parameter keyword is specified and request variable is supplied, but the parameter map is not setup to handle this parameter, the keyword is replaced with an empty string.
All input variables must be properly escaped using a database-specific format to avoid SQL injection attacks.
Special care has to be taken when escaping parameters used in LIKE queries with % signs. It may be necessary to escape a part of the LIKE statement after the keywords have been converted to their values and placed into the query. This is because in a query ... LIKE %this% ... quotes have to be around %this%, not just this, i.e. it should look this way ... LIKE '%this%' ...
Optional:
We could consider pre-compiling a query if it turns out that replacing keywords requires a significant amount of time. This will be done similar to bodycopies, where an intermediary PHP file is produced for quicker execution. In order to make the decision to pre-compile the query it is necessary to perform a comparative analysis, which will boil down to the difference between file I/O and regular expressions.