Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Variable can't contain backslash #57

Open
chitly opened this issue Jun 18, 2020 · 3 comments
Open

Variable can't contain backslash #57

chitly opened this issue Jun 18, 2020 · 3 comments
Labels
help wanted Extra attention is needed

Comments

@chitly
Copy link

chitly commented Jun 18, 2020

This is an example code.

const text = 'abc\\';
await client.execute('insert into users(name) values(?)', [text]);

This is a result of the query string.

insert into users(name) values("abc\")

So, it will throw an error.

@wenjoy
Copy link
Collaborator

wenjoy commented Jun 19, 2020

@chitly Thanks chitly, it's a really good issue.
@manyuanrong @zhmushan It should be an escape issue. Since this lib depends on module sql_builder, I prefer to handle such issue in that module. Thoughts?

@wenjoy wenjoy added the help wanted Extra attention is needed label Jun 19, 2020
@manyuanrong
Copy link
Member

I think it needs to be handled in sql_builder, and if the value ends with "", it can be very violent to directly add a "" at the end

ccouzens added a commit to ccouzens/sql-builder that referenced this issue Sep 23, 2020
When using replaceParams to insert a string into a SQL string, it should
escape backslashes as a pair of backslashes.

replaceParams escapes " characters as \".

Before this change, if the input string was
\"
then the output string would be
\\"
which would mean the " character was no longer escaped.

https://dev.mysql.com/doc/refman/8.0/en/string-literals.html#character-escape-sequences

This commit includes a few small other changes to replaceParams.
Where `indexOf` was used to determine if a string contained a pattern
I've replaced it with `includes`. This is better for people like me who
aren't primarily Javascript/Typescript programmers.

-        (val.toLowerCase().indexOf(" as ") > -1 ||
-          val.toLowerCase().indexOf(" AS ") > -1)

The 2nd condition was never true because if the string is forced lower
case it will never contain some uppper case characters.

denodrivers/mysql#57
@ccouzens
Copy link
Contributor

I've raised a pull request to fix this in sql-builder
manyuanrong/sql-builder#11

ccouzens added a commit to ccouzens/deno_mysql that referenced this issue Sep 30, 2020
This should fix the backslash problem in parameters:
denodrivers#57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
help wanted Extra attention is needed
Projects
None yet
Development

No branches or pull requests

4 participants