Bug #16235 ODBC driver doesn't format parameters correctly
Submitted: 5 Jan 2006 21:38 Modified: 6 Jun 2007 13:57
Reporter: Jarrad Waterloo
Status: Closed
Category:Connector/ODBC Severity:S1 (Critical)
Version:3.51 OS:Microsoft Windows (Windows XP Professional)
Assigned to: Jim Winstead Target Version:

[5 Jan 2006 21:38] Jarrad Waterloo
Description:
I get the following error from the following code:

Error:
[MySQL][ODBC 3.51 Driver][mysqld-5.0.18-nt]Unknown column 'Handheld' in 'where clause'

Code:
string Name = "Handheld";
DBConnectionConfiguration dbcc = new DBConnectionConfiguration();
string connectionString = dbcc.ConnectionString;
if(connectionString == string.Empty)
	throw new Exception("The RFID database has not been configured!");
Connection connection = new ConnectionClass();
connection.Open(connectionString, string.Empty, string.Empty,
(int)ConnectOptionEnum.adConnectUnspecified);
CommandClass command = new CommandClass();
command.ActiveConnection = connection;
command.CommandText = "SELECT Id FROM Devices WHERE Name = ?;";
command.CommandType = CommandTypeEnum.adCmdText;

Parameter parameter = command.CreateParameter("Name", DataTypeEnum.adBSTR,
ParameterDirectionEnum.adParamInput, Name.Length, Name);
command.Parameters.Append(parameter);

object o = Type.Missing;
Recordset recordset = command.Execute(out o, ref o, (int)CommandTypeEnum.adCmdText); //
exception gets thrown here
Guid Id;
if(recordset.EOF)
	Id = Guid.Empty;
else
	Id = Helpers.EnsureGuid(recordset.Fields["Id"]);
connection.Close();
return Id;

Cause:

Needed Resolution:

How to repeat:
1) Run the code or
2) run this staement - SELECT Id FROM Devices WHERE Name = Handheld;

Suggested fix:
The problem is that the ODBC driver is not correctly formatting string parameters that are
passed to it by putting quotes around it and escaping any quotes in the string parameter.
I haven't tested yet but if this formatting problem is occuring with strings than binary
and Guid types are also not being formatted/converted correctly. This fix is necessary and
critical because most decent ODBC drivers on the market, Microsoft, Oracle and Firebird,
handles parameter formatting. That is one chief reason why people use parameters. Further
it would defeat the purpose of using an abstraction layer like ODBC if the MySQL ODBC
driver is not consistent with the [expected] standard as this would require custom, non
standard, coding per provider!
[6 Jan 2006 11:47] Bogdan Degtyariov
It is a known problem related with adBSTR type.
If you use adVarchar it should be ok. The patch for this bug is being prepared, but there
are possible some problems.
[6 Jan 2006 15:13] Jarrad Waterloo
How far out is this patch? As I am using this and similar for Microsoft and Oracle, I
would rather wait a short period of time than risk breaking something that is working well
in other implementations.
[6 Jan 2006 16:05] Jarrad Waterloo
adVarWChar has the same problem as adBSTR
[11 Apr 2006 1:18] Adrian Sandor
I've been (violently) hit by this very same bug, using MySQL 4.1.11 and MyODBC 3.51.12 on
Windows XP. The command parameter type was adVarWChar.
I confirm that after changing to adVarChar, there is no error. But I guess this means
non-ASCII characters will be lost, which is horrible. Will this be fixed soon?
[28 Nov 2006 12:44] Audun
The bug seems not to be fixed yet. The 3.51 Connector doesn't put single quotes around
literal strings, so instead I have to use triple quotes around strings in the programming
code. The producer of the programming language says that "the mySQL Connector team must be
doing left-hand work."  
So,don't you take ODBC seriously?
Will this bug be fixed in Connector 3.51 at all? Will it be fixed in Connector 5,x?

Regards
Audun
[10 May 2007 4:30] Jim Winstead
Bug #13319 was marked as a duplicate of this bug.
[10 May 2007 4:37] Jim Winstead
As far as we can figure, adBSTR is sometimes mapped the same as adVarWChar which is mapped
to SQL_WVARCHAR (or possibly SQL_WLONGVARCHAR), which is not being handled properly. The
workaround is to use adVarChar, but this will be fixed in a future release of 3.51.
[10 May 2007 19:28] Jim Winstead
patch to handle SQL_WVARCHAR and SQL_WLONGVARCHAR as we do SQL_WCHAR

Attachment: bug16235.patch (application/octet-stream, text), 2.39 KiB.

[21 May 2007 19:30] Jim Winstead
The fix for this bug has been committed to the source repository, and will be in the next
release (3.51.16). Thanks for the bug report.
[6 Jun 2007 13:57] MC Brown
A note has been added to the 3.51.16 changelog.