|
On MariaDB, strings can be equal to 0 (integer).
MariaDB [(none)]> select 'xyz'=0;
|
+---------+
|
| 'xyz'=0 |
|
+---------+
|
| 1 |
|
+---------+
|
1 row in set, 1 warning (0.000 sec)
|
This is contrary to most users' expectations in my opinion.
Postgres, Oracle, SQL Server, DB2, SQLite don't behave like this.
Security implication of this has been publicly discussed since 2013.
https://web.archive.org/web/20150216184354/http:/www.phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails/
https://github.com/rails/rails/pull/16069
https://github.com/rails/rails/pull/42440
In data-changing statements, such bad string-to-number conversion triggers an error thanks to STRICT_TRANS_TABLES. My request is to add a new strict SQL mode that does the same for SELECT statements.
|