<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.3492" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=031093008-26012009>Hi,</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=031093008-26012009></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=031093008-26012009>Not any great hazard, I believe, if it means that
user can normally get all the features, but only a subset when filter
is set. It is different case if DATA clause is manipulated, and
therefore that must be connected to DATAPATTERN.</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=031093008-26012009></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=031093008-26012009>-Jukka Rahkonen-</SPAN></FONT></DIV><BR>
<BLOCKQUOTE
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader lang=fi dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>Lähettäjä:</B>
mapserver-users-bounces@lists.osgeo.org
[mailto:mapserver-users-bounces@lists.osgeo.org] <B>Puolesta
</B>umn-ms@hydrotec.de<BR><B>Lähetetty:</B> 26. tammikuuta 2009
10:03<BR><B>Vastaanottaja:</B> MapServer<BR><B>Aihe:</B> Re: [mapserver-users]
Dynamin SQL with mapserver CGI?<BR></FONT><BR></DIV>
<DIV></DIV><BR><FONT face=sans-serif size=2>Hi </FONT><BR><BR><TT><FONT
size=2>> You can use a replaceable parameter in the FILTER clause if all
you ...</FONT></TT> <BR><TT><FONT size=2>This introduces the hazard of
SQL-Injection, doesn't it?</FONT></TT> <BR><BR><TT><FONT
size=2>Bye</FONT></TT> <BR><TT><FONT size=2>Benedikt Rothe</FONT></TT>
<BR><BR><TT><FONT size=2>mapserver-users-bounces@lists.osgeo.org schrieb am
24.01.2009 14:04:42:<BR><BR>> On Sat, Jan 24, 2009 at 3:18 AM, Saka Royban
<srph124@yahoo.com> wrote:<BR>> > Hi all<BR>> > I'm looking
for a way to change SQL dynamically via URL parameters. it<BR>> > sounds
from doc that changing DATA element in map file is impossible. Is<BR>> >
there any other way?<BR>> <BR>> You can use a replaceable parameter in
the FILTER clause if all you<BR>> want to do is alter the WHERE clause. So
for example:<BR>> FILTER "%criteria%"<BR>> and<BR>>
criteria=id='value'<BR>> would work with a database like
Postgres.<BR>> <BR>> When working with a database you put the whole SQL
WHERE clause in the<BR>> FILTER, whereas with shapefiles or ORG data
sources you use the<BR>> FILTERITEM and FILTER.<BR>> <BR>> --
<BR>> Richard Greenwood<BR>> richard.greenwood@gmail.com<BR>>
www.greenwoodmap.com<BR>>
_______________________________________________<BR>> mapserver-users
mailing list<BR>> mapserver-users@lists.osgeo.org<BR>>
http://lists.osgeo.org/mailman/listinfo/mapserver-users<BR></BLOCKQUOTE></FONT></TT></BODY></HTML>