[ic] mv_sql_query question

[interchange-users@icdevgroup.org (Kevin Walsh)]

Dennis Chen [dchen@technicacorp.com] wrote:
> 
> We have a pretty weird "price" situation as it's caculated on the fly from
> the listunitprice*discount_pct
> so there is no actual price field.  I'm trying to do a range search with
> 
> 	<input type=text name=min >
> 	<input type=text name=max >
> 	<input type=hidden name=mv_sql_query value="
> 	  SELECT sku
>   	  FROM products
> 	  where (listunitprice*discount_pct) > min
> 	  and (listunitprice*discount_pct) < max">
> 
> but this does not seem to work as it gives me a "Bad SQL" error on the
> screen.  I found out the error is caused by the ( ) in the statment.  Anyway
> get around this besides creating a new price field?  It works fine when I
> run the query in mysql.
> 
The mv_sql_query text is interpreted by the SQL::Statement module,
rather than passed to MySQL.  If it was then the following would be
possible:

    <input type=hidden name=mv_sql_query value="DELETE FROM products">

SQL::Statement is not a full SQL parser, as you have found.

I suggest that you call a page with your min/max values.  The called
page can use [query] to do anything you need, with direct access to
your SQL server.

-- 
   _/   _/  _/_/_/_/  _/    _/  _/_/_/  _/    _/
  _/_/_/   _/_/      _/    _/    _/    _/_/  _/   K e v i n   W a l s h
 _/ _/    _/          _/ _/     _/    _/  _/_/    kevin@cursor.biz
_/   _/  _/_/_/_/      _/    _/_/_/  _/    _/