*** 53,58 **** --- 53,81 ---- The pApi argument contains pointers back to all of the APIs in the calling library. Extensions should reference the SQLite API through these pointers. + + <h2>Security Considerations</h2> + + <p>Some programs allow users to enter SQL statements then check those + statements using <a href="/capi3ref.html#sqlite3_set_authorizer"> + sqlite3_set_authorizer()</a> to prevent attacks against the program. + The new load_extension() SQL function described above could circumvent + this protection and open holes in legacy applications. To avoid this, + the entire extension loading mechanism is turned off by default. To + enable the extension loading mechanism, first invoke this API:</p> + + <blockquote><pre> + int sqlite3_enable_load_extension(sqlite3 *db, int onoff); + </pre></blockquote> + + <p>The <tt>onoff</tt> parameter is true to enable extension loading and + false to disable it. This allows programs that want to run user-entered + SQL to do so safely by first turning off extension loading. Extension + loading is off by default so that if an older program links against a + newer version of SQLite it will not open a potential exploit.</p> + + + <h2>Example Extension</h2> <p> The following code is an example of how to build a loadable extension: <blockquote><pre>
Small. Fast. Reliable.
Choose any three.
Choose any three.
|
|