builder

builder copied to clipboard

ToBoundSQL函数 不能过滤参数防止SQL注入吗？

6

代码： name := "cat;sleep(1)" build := builder.MySQL() sql, err := build.Select("*").From(table).Where(builder.Cond(builder.Eq{"name": name})).ToBoundSQL() 生成的sql语句是：SELECT * FROM t_tmp_info WHERE name='cat;sleep(1)' 并没有将sleep(1)过滤掉

xuyuri

- [x] Mysql - [ ] Oracle - [ ] Postgre - [ ] Sqlite - [ ] Mssql

BetaCat0

Not entirely sure how the previous implementation was supposed to work. With SQL Server 2008 there is support for [OFFSET and FETCH clauses](https://docs.microsoft.com/en-us/sql/t-sql/queries/select-order-by-clause-transact-sql?view=sql-server-2017#using-offset-and-fetch-to-limit-the-rows-returned).

n1xx1

How to use Mysql's "regexp" or postgresql's "～*" ?

1

mysql: select * from user where name regexp '^tom'; postgresql: select * from user where name ~* '^[a-h]'

walnut-tom

Cond interface needs iterator to edit the conditions. Suppose ID=10 is already given. If in some cases, we might change the ID=15. But Now we have to create new condition.

kumarsiva07

Struct to sql query for create table and drop table

kumarsiva07