Mailing-List: contact user-help@cassandra.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@cassandra.apache.org
Received-SPF: pass (athena.apache.org: domain of sylvain@datastax.com
 designates 209.85.161.172 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAEFZHGPbBLmS_JcZqGSGHqzt53XTH=rYmMvaCdAzUJjeiqSG9A@mail.gmail.com>
References: 
 <CAEFZHGPbBLmS_JcZqGSGHqzt53XTH=rYmMvaCdAzUJjeiqSG9A@mail.gmail.com>
Date: Thu, 21 Jun 2012 08:56:02 +0200
Message-ID: 
 <CAKkz8Q3OL7pwiG0kd5jDBesUwgrMBqJBFLcOZq4N9qpw7-pp_Q@mail.gmail.com>
Subject: Re: When will CQL BATCH support binding variable (Query substitution
 use named parameters)?
From: Sylvain Lebresne <sylvain@datastax.com>
To: user@cassandra.apache.org
Content-Type: text/plain; charset=ISO-8859-1

On Thu, Jun 21, 2012 at 12:06 AM, Data Craftsman
<database.craftsman@gmail.com> wrote:
> Hello,
>
> CQL BATCH is good for INSERT/UPDATE performance.
>
> But it cannot do binding variable, exposed to SQL injection.
>
> Is there a plan to make CQL BATCH to support binding variable in near future?
>
> e.g.
> http://code.google.com/a/apache-extras.org/p/cassandra-dbapi2/
>
> Query substitution
> Use named parameters and a dictionary of names and values.
>
>>> cursor.execute("SELECT column FROM CF WHERE name=:name", dict(name="Foo"))

That may be a problem with the python driver (cassandra-dbapi2) and
you'd want to open an issue there.

But note that the "query substitution" of the python driver is *not*
related to CQL prepared statements (that use question marks for bound
variables). Those support BATCH all right.

--
Sylvain