Skip to content

Fix element reference in CQN example on avoiding SQL injection #1104

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jul 12, 2024
Merged

Fix element reference in CQN example on avoiding SQL injection #1104

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4756a8b
Fix element reference in CQN example on avoiding SQL injection
qmacro Jul 12, 2024
0491e82
Super minor lang fix
qmacro Jul 12, 2024
1917ee7
another minor fix colums -> columns
qmacro Jul 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions node.js/cds-ql.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,7 +149,7 @@ The query is...

1. captured as a CQN object with the where clause represented as:
```js
..., where:[ {ref:['title']}, '=', {val:201} ]
..., where:[ {ref:['ID']}, '=', {val:201} ]
```

2. translated to plain SQL string with binding parameters
Expand All @@ -162,7 +162,7 @@ SELECT ID from Books where ID=?
dbc.run (sql, [201])
```

The only mistake you could do is to imperatively concatenate user input with CQL or SQL fragments, instead of using the tagged strings or other options promoted by `cds.ql`. For example, assumed you had written the above code sample like that:
The only mistake you could make is to imperatively concatenate user input with CQL or SQL fragments, instead of using the tagged strings or other options promoted by `cds.ql`. For example, assumed you had written the above code sample like that:

```js
let input = 201 //> might be entered by end users
Expand Down Expand Up @@ -326,10 +326,10 @@ SELECT.distinct.from (Authors)
### columns() {.method}

```tsx
function SELECT.colums ( projection : function )
function SELECT.colums ( cql : tagged template string )
function SELECT.colums ( columns[] : CQL expr string | CQN expr object )
function SELECT.colums ( ...columns[] : CQL expr string | CQN expr object )
function SELECT.columns ( projection : function )
function SELECT.columns ( cql : tagged template string )
function SELECT.columns ( columns[] : CQL expr string | CQN expr object )
function SELECT.columns ( ...columns[] : CQL expr string | CQN expr object )
```

Specifies which columns to be fetched, very much like SQL select clauses, enhanced by [CQL](../cds/cql) projections and path expressions. The arguments can be a projection function, a tagged template string, or individual column expressions as CQL string snippets, or as [CQN column expression objects](../cds/cqn.md#select).
Expand Down