coalesce() incorrectly expands constant values

[nextghost]

When you pass string constant into coalesce, it will be expanded as identifier instead of string constant:
db().select(db.table.str_field.coalesce('foo'))
would expand into this:
SELECT COALESCE(table.str_field,foo) FROM table
but the expected behavior is this:
SELECT COALESCE(table.str_field,'foo') FROM table

[nextghost]

And before you fix this just by passing the field_type argument to expand() in BaseAdapter.COALESCE(), don't you think it's extremely dangerous to let plain string objects pass straight through BaseAdapter.expand() without any escaping?

[gi0baro]

@nextghost Might be dangerous only when the user explicitly pass something bad to expand() or when we forgot a field_type argument, like in this case.

What would be your suggestion? Escape 'em all?

[nextghost]

@gi0baro Exactly, escape 'em all except when explicitly told not to. That way, minor oversights like this won't result in potential SQL injection vulnerabilities. This one might be 99.9% benign but there might be more like it in another part of code that's more often exposed to the open Internet. Escaping by default gives you pretty strong protection almost for free.

[gi0baro]

@mdipierro @niphlod what do you think?

[mdipierro]

I think if we pass a string, we should escape it by calling the represent function.

[gi0baro]

In the meantime we discuss this in a more appropriate way, I have pushed PR #349 that solve just the coalesce problem.

Now @nextghost can hate me ^^"

[gi0baro]

I'm re-opening this to continue with the discussion about the escape 'em all.