mirror of
https://github.com/RGBCube/serenity
synced 2025-05-14 11:24:58 +00:00
LibSQL: Parse and execute sequential placeholder values
This partially implements SQLite's bind-parameter expression to support indicating placeholder values in a SQL statement. For example: INSERT INTO table VALUES (42, ?); In the above statement, the '?' identifier is a placeholder. This will allow clients to compile statements a single time while running those statements any number of times with different placeholder values. Further, this will help mitigate SQL injection attacks.
This commit is contained in:
parent
53f8d62ea4
commit
b2b9ae27fd
10 changed files with 154 additions and 30 deletions
|
@ -131,6 +131,19 @@ TEST_CASE(null_literal)
|
|||
validate("NULL"sv);
|
||||
}
|
||||
|
||||
TEST_CASE(bind_parameter)
|
||||
{
|
||||
auto validate = [](StringView sql) {
|
||||
auto result = parse(sql);
|
||||
EXPECT(!result.is_error());
|
||||
|
||||
auto expression = result.release_value();
|
||||
EXPECT(is<SQL::AST::Placeholder>(*expression));
|
||||
};
|
||||
|
||||
validate("?"sv);
|
||||
}
|
||||
|
||||
TEST_CASE(column_name)
|
||||
{
|
||||
EXPECT(parse(".column_name"sv).is_error());
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue