New SQL backend

[jedmccaleb]

[roosmaa]

Poked around the goSQL branch a bit, and noticed something: the SQL statements are constructed in a way which enables SQL injection if not über careful.

Most of the time the inputs are either number or base-something-encoded-strings, which works out OK. But sometimes (eg LedgerDatabase.cpp:35) they are not and it's not immediately clear if this could be used to cause mischief.

With the current boost::format approach it is also very easy to add new parameters to the SQL which aren't sanitised and introduce hard to notice problems until it's too late.

So, I was wondering, why not use the SQL prepare & bind approach? Can't be that it has such a bad performance hit?!

[MonsieurNicolas]

Thanks for taking a look!

I actually made the change you suggested a few days ago: look at my latest changes off the pending PR LedgerDatabase.cpp:75.

We started using the "wrong" sql wrapper for this (didn't realize there was a legacy and new one in the codebase): the ripple code base has beast::sqdb that provides what we need. I would love to move to that wrapper instead. I created a new issue #152 to move to that wrapper and drop the current patterns.

If you have some time, feel free to take a stab at it.