Class: TMMClientBase
Declared in: EDBMMClient
Abstract base class for TMMScript and TMMUpdater.
Owns the HTTP transport (TMMHttpClient),
holds the reference to the shared TMMConnection,
and manages the SQL parameter collection used for named-parameter
substitution.
TMMClientBase is a TComponent
descendant.
It is not instantiated directly — use TMMScript or
TMMUpdater.
| Properties | Events |
|---|---|
Connection |
OnLog |
Params |
property Connection: TMMConnection; // publishedReference to the shared TMMConnection
that provides the API endpoint, credentials, and server limits. Not
owned by TMMClientBase; the application is responsible for
the connection’s lifetime.
You can change Connection between calls; the new values
take effect on the next Execute or Prefetch
call.
When the assigned TMMConnection is freed,
Connection is cleared automatically to prevent dangling
references. This works both at design time (IDE) and at runtime — the
setter calls FreeNotification on the assigned
TMMConnection so that the
Notification(opRemove) mechanism fires correctly when the
component is destroyed.
Connection is published and appears in the
Object Inspector when the component is placed on a form or data
module.
property Params: TParams; // published (read-only; mutate in place)SQL parameter collection for named-parameter substitution. Parameters
are named tokens of the form :name in the SQL
or Where expressions of TMMScript and
TMMUpdater. Each parameter is substituted with a safe SQL
literal before the query is sent to the server:
| Type group | Delphi field types | SQL literal produced |
|---|---|---|
| Text | ftString, ftWideString,
ftFixedChar, ftFixedWideChar,
ftMemo, ftWideMemo, ftFmtMemo,
ftOraClob |
Single-quoted; backslash → \\, single quote →
'' |
| Integer (32-bit) | ftSmallint, ftInteger,
ftWord, ftShortint, ftByte,
ftAutoInc |
Bare integer, no quotes |
| Integer (64-bit) | ftLargeint, ftLongWord,
ftLargeUint |
Bare integer, no quotes |
| Floating-point | ftFloat, ftCurrency,
ftSingle, ftExtended |
Dot-decimal, no quotes |
| Exact decimal | ftBCD, ftFMTBcd |
Dot-decimal string (exact; no conversion through
Double) |
| Binary | ftBytes, ftVarBytes, ftBlob,
ftGraphic, ftParadoxOle,
ftDBaseOle, ftTypedBinary,
ftOraBlob |
MySQL hex literal X'hexdigits' |
| Boolean | ftBoolean |
1 or 0 |
| Date | ftDate |
'yyyy-mm-dd' |
| Time | ftTime |
'hh:nn:ss.zzz' |
| Date/time | ftDateTime, ftTimeStamp,
ftOraTimeStamp |
'yyyy-mm-dd hh:nn:ss.zzz' |
| GUID | ftGuid |
Single-quoted UUID string; enclosing braces removed |
| Null | any type with IsNull = True |
NULL |
| Other | unrecognised types | Single-quoted string via AsString; backslash and single
quote escaped |
Params are not cleared automatically between
Execute or Prefetch calls, so the same set of
values can be reused across multiple calls. Clear the collection
manually when the parameter set changes.
Tokens inside single-quoted strings, double-quoted strings or identifiers, and backtick-quoted identifiers are never substituted. A colon that is immediately preceded by an alphanumeric character or underscore is not treated as a parameter prefix.
Security note: Parameter substitution is client-side literal encoding, not server-side prepared statements. It is safe against SQL injection under normal conditions (MySQL with
utf8mb4charset and defaultsql_mode): numeric, boolean, and binary values carry no user-controlled text; string values have backslash escaped to\\and single quotes doubled to''before being wrapped in single quotes. If the MySQL server is configured withNO_BACKSLASH_ESCAPES, the backslash doubling is redundant but harmless for injection safety — single-quote doubling alone is sufficient in that mode. Multibyte charset attacks (e.g. GBK) are not a concern when the connection usesutf8mb4.
property OnLog: TMMLogEvent; // publishedLog callback. Assign a method to receive log messages from both the
application layer and the HTTP transport layer in one place.
OnLog is published and appears in the Object
Inspector. See TMMLogEvent.