NAME

Class::DBI::Plugin::AutoUntaint - untaint columns automatically

SYNOPSIS

  package Film;
  use Class::DBI::FromCGI;
  use Class::DBI::Plugin::AutoUntaint;
  use base 'Class::DBI';
  # set up as any other Class::DBI class.
  
  # instead of this:
  #__PACKAGE__->untaint_columns(
  #    printable => [qw/Title Director/],
  #    integer   => [qw/DomesticGross NumExplodingSheep],
  #    date      => [qw/OpeningDate/],
  #    );
  
  # say this:
  __PACKAGE__->auto_untaint;

DESCRIPTION

Automatically detects suitable default untaint methods for most column types. Calls die with an informative message for any columns it can't figure out. Accepts arguments for overriding the default untaint type.

METHODS

auto_untaint( [ %args ] )

The following options can be set in %args:

untaint_columns

Specify untaint types for specific columns:

untaint_columns => { printable => [ qw( name title ) ],
                     date => [ qw( birthday ) ],
                     }
                     

skip_columns

List of columns that will not be untainted:

skip_columns => [ qw( secret_stuff internal_data ) ]

match_columns

Use regular expressions matching groups of columns to specify untaint types:

match_columns => { qr(^(first|last)_name$) => 'printable',
                   qr(^.+_event$) => 'date',
                   qr(^count_.+$) => 'integer',
                   }
                   

untaint_types

Untaint according to SQL data types:

untaint_types => { enum => 'printable',
                   }
                   

Defaults are taken from Class::DBI::FromCGI::column_type_for(), but things like enum don't have a universal default but might have a sensible default in a particular application.

match_types

Use a regular expression to map SQL data types to untaint types:

match_types => { qr(^.*int$) => 'integer',
                 }
                 

debug

Control how much detail to report (via warn) during setup. Set to 1 for brief info, and 2 for a list of each column's untaint type.

TODO

Tests!

SEE ALSO

Class::DBI::FromCGI.

AUTHOR

David Baird, <cpan@riverside-cms.co.uk>

BUGS

Please report any bugs or feature requests to bug-class-dbi-plugin-autountaint@rt.cpan.org, or through the web interface at http://rt.cpan.org/NoAuth/ReportBug.html?Queue=Class-DBI-Plugin-AutoUntaint. I will be notified, and then you'll automatically be notified of progress on your bug as I make changes.

ACKNOWLEDGEMENTS

COPYRIGHT & LICENSE

Copyright 2005 David Baird, All Rights Reserved.

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.