Simple and safe SQL queries with c++ templates

Abstract

Most software applications use a relational database for data man-agement and storage. Interaction with such a database is often done by letting the program construct strings with valid SQL statements, which are then sent for execution to the database engine. The fact that these statements are only checked for correctness at runtime is a source for many potential problems such as type and syntax errors and vulnerability to injection attacks. The ARARAT system presented here offers a method for dealing with these predicaments, by coercing the host C++ compiler to do the necessary checks of the generated strings. A library of templates (and preprocessor directives) effectively extends C++ with a little language representing an augmented relational algebra formalism. Type checking of this language extension, as done by the template library, assures, at compile-time, the correctness of the generated SQL strings. All SQL statements constructed by the system are immune to injection attacks. Standard techniques (e.g., “expression templates”) for compile time representation of symbolic structures, are enhanced by our system to support a type system and a symbol table lookup of the symbolic structure. Our work may also open the way for embed-ding other domain specific languages in C++. 1.