--- html5/webdatabase/Overview.html	2009/10/04 10:14:19	1.36
+++ html5/webdatabase/Overview.html	2009/10/27 08:23:43	1.43
@@ -26,6 +26,7 @@
    table { border-collapse: collapse; border-style: hidden hidden none hidden; }
    table thead { border-bottom: solid; }
    table tbody th:first-child { border-left: solid; }
+   table tbody th { text-align: left; }
    table td, table th { border-left: solid; border-right: solid; border-bottom: solid thin; vertical-align: top; padding: 0.2em; }
    blockquote { margin: 0 0 0 2em; border: 0; padding: 0; font-style: italic; }
 
@@ -167,18 +168,18 @@
   </style><link href="http://www.w3.org/StyleSheets/TR/W3C-WD" rel="stylesheet" type="text/css"><div class="head">
    <p><a href="http://www.w3.org/"><img alt="W3C" height="48" src="http://www.w3.org/Icons/w3c_home" width="72"></a></p>
    <h1>Web Database</h1>
-   <h2 class="no-num no-toc" id="w3c-working-draft-10-september-2009">W3C Working Draft 10 September 2009</h2> <!-- ZZZ -->
+   <h2 class="no-num no-toc" id="w3c-working-draft-27-october-2009">W3C Working Draft 27 October 2009</h2> <!-- ZZZ -->
 
    <dl><dt>This Version:</dt>
-    <dd><a href="http://www.w3.org/TR/2009/WD-webdatabase-20090910/">http://www.w3.org/TR/2009/WD-webdatabase-20090910/</a></dd> <!-- ZZZ date x2 -->
+    <dd><a href="http://www.w3.org/TR/2009/WD-webdatabase-20091027/">http://www.w3.org/TR/2009/WD-webdatabase-20091027/</a></dd>
     <dt>Latest Published Version:</dt>
     <dd><a href="http://www.w3.org/TR/webdatabase/">http://www.w3.org/TR/webdatabase/</a></dd>
     <dt>Latest Editor's Draft:</dt>
     <dd><a href="http://dev.w3.org/html5/webdatabase/">http://dev.w3.org/html5/webdatabase/</a></dd>
-<!-- ZZZ: add the new version after it has shipped
+<!-- ZZZ: add the new version after it has shipped-->
     <dt>Previous Versions:</dt>
-    <dd><a href="http://www.w3.org/TR/2009/WD-webdatabase-20090423/">http://www.w3.org/TR/2009/WD-webdatabase-20090423/</a>
- :ZZZ -->
+    <dd><a href="http://www.w3.org/TR/2009/WD-webstorage-20090423/">http://www.w3.org/TR/2009/WD-webstorage-20090423/</a> <!-- yes, storage, not db -->
+<!-- :ZZZ -->
     <dt>Editors:</dt>
     <dd><a href="mailto:ian@hixie.ch">Ian Hickson</a>, Google, Inc.</dd>
    </dl><p class="copyright"><a href="http://www.w3.org/Consortium/Legal/ipr-notice#Copyright">Copyright</a>
@@ -513,7 +514,7 @@ interface <dfn id="databasecallback">Dat
   instead of the user agent prompting the user for permission to
   increase the quota every five megabytes.<h3 id="parsing-and-processing-sql-statements"><span class="secno">4.2 </span>Parsing and processing SQL statements</h3><p>When the user agent is to <dfn id="preprocess-the-sql-statement" title="preprocess the SQL
   statement">preprocess a SQL statement</dfn> <var title="">sqlStatement</var> with an array of arguments <var title="">arguments</var>, it must run the following steps:<ol><li><p>Parse <var title="">sqlStatement</var> as a SQL statement,
-   with the exception that U+003F QUESTION MARK (?) characters can be
+   with the exception that U+003F QUESTION MARK characters (?) can be
    used in place of SQL literals in the statement. <a href="#refsSQL">[SQL]</a></li>
 
    <li>
@@ -1069,6 +1070,7 @@ interface <dfn id="sqltransactionsync">S
      reasonable time.
 
   </table><h2 id="web-sql"><span class="secno">5 </span>Web SQL</h2><p class="XXX">Need to define the SQL dialect.<h2 id="disk-space"><span class="secno">6 </span>Disk space</h2><p>User agents should limit the total amount of space allowed for
+  
   databases.
   
   <p>User agents should guard against sites storing data under the
@@ -1084,7 +1086,7 @@ interface <dfn id="sqltransactionsync">S
   future.<h2 id="privacy"><span class="secno">7 </span>Privacy</h2><h3 id="user-tracking"><span class="secno">7.1 </span>User tracking</h3><p>A third-party advertiser (or any entity capable of getting
   content distributed to multiple sites) could use a unique identifier
   stored in its
-  client-side database
+  client-side databases
   
   to track a user across multiple sessions, building a profile of the
   user's interests to allow for highly targeted advertising. In
@@ -1109,8 +1111,8 @@ interface <dfn id="sqltransactionsync">S
    <dt>Expiring stored data</dt>
    <dd>
 
-    <p>User agents may automatically delete stored data after a period
-    of time.</p>
+    <p>User agents may, if so configured by the user, automatically
+    delete stored data after a period of time.</p>
 
 
     <p>This can restrict the ability of a site to track a user, as the
@@ -1118,10 +1120,11 @@ interface <dfn id="sqltransactionsync">S
     sessions when he authenticates with the site itself (e.g. by
     making a purchase or logging in to a service).</p>
 
-    <p>However, this also puts the user's data at risk.</p>
+    <p>However, this also reduces the usefulness of the API as a
+    long-term storage mechanism. It can also put the user's data at
+    risk, if the user does not fully understand the implications of
+    data expiration.</p>
 
-    <!--v2 consider adding an explicit way for sites to state when
-    data should expire, as in  localStorage.expireData(365); -->
 
    </dd>
 
@@ -1130,12 +1133,11 @@ interface <dfn id="sqltransactionsync">S
 
     <p>If users attempt to protect their privacy by clearing cookies
     without also clearing data stored in the
-
-    database
     
-
-    feature, sites can defeat those attempts by using the two features
-    as redundant backup for each other. User agents should present the
+    relevant databases,
+    
+    sites can defeat those attempts by using the two features as
+    redundant backup for each other. User agents should present the
     interfaces for clearing these in a way that helps users to
     understand this possibility and enables them to delete data in all
     persistent storage features simultaneously. <a href="#refsCOOKIES">[COOKIES]</a></p>
@@ -1204,10 +1206,12 @@ interface <dfn id="sqltransactionsync">S
   from that domain. To mitigate this, pages can use SSL. Pages using
   SSL can be sure that only pages using SSL that have certificates
   identifying them as being from the same domain can access their
+  
   databases.
   
   <h3 id="cross-directory-attacks"><span class="secno">8.2 </span>Cross-directory attacks</h3><p>Different authors sharing one host name, for example users
   hosting content on <code>geocities.com</code>, all share one
+  
   set of databases.
   
   There is no feature to restrict the access by pathname. Authors on
@@ -1240,6 +1244,9 @@ interface <dfn id="sqltransactionsync">S
   JavaScript is implicitly UTF-16.<h3 id="sql-injection"><span class="secno">8.5 </span>SQL injection</h3><p>Authors are strongly recommended to make use of the <code title="">?</code> placeholder feature of the <code title="dom-sqltransaction-executeSql"><a href="#dom-sqltransaction-executesql">executeSql()</a></code> method,
   and to never construct SQL statements on the fly.</p><!--START vCard--><!--START vEvent--><h2 class="no-num" id="references">References</h2><!--REFS--><!--END vCard--><!--END vEvent--><p>All references are normative unless marked "Non-normative".</p><!--START vCard--><!--START vEvent--><dl><dt id="refsCOOKIES">[COOKIES]</dt>
    <!--
+   <dd><cite><a href="http://www.ietf.org/rfc/rfc2109.txt">HTTP State
+   Management Mechanism</a></cite>, D. Kristol, L. Montulli. IETF,
+   February 1997.</dd>
    <dd><cite><a href="http://www.ietf.org/rfc/rfc2965.txt">HTTP State Management
    Mechanism</a></cite>, D. Kristol, L. Montulli. IETF, October 2000.</dd>
    -->