escape variables in question bank columns sql

[dionysius]

While all used variables are currently safe, this must be considered accidental. We should escape all usages of variables in this query. The question bank column classes really need an overhaul to correctly escape input data!

[dionysius]

This PR should simplify the use of the "current" user and studentquiz id in the question bank column queries. First it improves maintainability by not needing to define those all the time, secondly in case additional sanitation has to be made, it is in a well defined place, and thirdly it reduces load to prepare the "big query" by not needing to find the additional field values.

Moodle has the option to use :variablename in queries, but unfortunately you cannot use that multiple times. This way, you have a joined "table" current providing those fields as static select elements and you can always use those as conditions for further joins. I expect the performance also to be better as the database can earlier filter the joined tables according to the on conditions. But that statement is just from expectation, there's a chance that I'm totally wrong and its worse and thus needs to be tested as well.

[dionysius]

With help of 0a8d71c:

TEST_PERF: create 1 instances
TEST_PERF: initialization complete
TEST_PERF: displaying question bank took 0.21114706993103 s
TEST_PERF: create 10 instances
TEST_PERF: initialization complete
TEST_PERF: displaying question bank took 0.52533197402954 s
TEST_PERF: create 100 instances
TEST_PERF: initialization complete
TEST_PERF: displaying question bank took 0.23308610916138 s

But this approach doesn't like pgsql. Putting PR aside for a bit

[timhunt]

I don't see why this would not work in Postgres. Perhaps you need to add ON 1 = 1?

In studentquiz_bank_view.php, you should be able to do JOIN (SELECT ? as userid, ? as studentquizid) current and put those values in the $params array.

[dionysius]

I don't see why this would not work in Postgres. Perhaps you need to add ON 1 = 1?

I can give that a try.

In studentquiz_bank_view.php, you should be able to do JOIN (SELECT ? as userid, ? as studentquizid) current and put those values in the $params array.

Yes definitely, now we can do that.