Is it a good way to use system() for database scripts from C?

Question

I was searching for connecting to database from C program. But I thought the ODBC connections, logon and all need some libraries. Also I am having a minimal compiler like Tiny C Compiler which is very fast. I do not want to use any ODBC logic etc which is needed to connect and query the database.

So I am using a method which is as follows.

I use a bteq script (teradata) which will have login, query, logoff commands in that. (FYI bteq is a command line database utility. You can use it similar to mysql.exe in command prompt by going to the path of the exe. You can replace bteq with mysql.exe etc). And I use

system("bteq <myscript.txt >out.txt");

myscript.txt will be like the following..

.logon boxname/user,password;
select date;
.logoff;

The above script will logon to the database and query date (you can change the query and write script according to your database engine and your needs) and give output into out.txt.

Now I will parse the out.txt for the row X column I want using fgetc,fscanf or fgets. And use the data for checking and send a mail using PHP on any server

system("c:/server/php/php.exe sendmail.php");.

We can do the same for many a database engines like mysql, .. etc through a simple C program.

Now my question is Is there any flaw in the above method. If it is then how can I overcome it. I am asking this question because I think this method is unconventional. Please give your opinions on this method. I don't bother about time needed for execution, RAM used, performance issues etc. I know system() function is time consuming which is not my concern anyway. I also developed specific functions to access query results (similar to accessing a flat file). Please tell me if you have any improvements to this method. If you get to know of any flaws in this please let me know. All kinds of suggestions are welcome.

My environment is : teradata bteq on windows with Tiny C Compiler

Answer 1

This is a perfectly fine way to access an external database, as long as your needs are simple. If you already know about the performance and memory implications of doing this, then there's not much more to say.

Answer 2

The method is fine: it's great to decouple the db subsystem and the parser subsystem by implementing them in an appropriate language.

There's just this tiny little thing - but I may be mistaken because I'm not familiar with bteq: the program will need a bteq script installed in the execution folder; this script will contain username and password. If those aren't encripted in some way, there might be a security flaw.

Answer 3

I wouldn't recommend this if your calling code is running setuid or setgid, but in that case you could use one of the exec() functions instead. (There are a few other considerations you may wish to take into account, all detailed in man 3 system.)