RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 13:28:11 +00:00
Code Issues Activity Actions

LibSQL: Parse and execute sequential placeholder values

Browse source 
This partially implements SQLite's bind-parameter expression to support
indicating placeholder values in a SQL statement. For example:

    INSERT INTO table VALUES (42, ?);

In the above statement, the '?' identifier is a placeholder. This will
allow clients to compile statements a single time while running those
statements any number of times with different placeholder values.

Further, this will help mitigate SQL injection attacks.
This commit is contained in:
Timothy Flynn 2022-12-01 22:20:55 -05:00 • committed by Andreas Kling
parent 53f8d62ea4
commit b2b9ae27fd
10 changed files with 154 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

20
Userland/Libraries/LibSQL/AST/AST.h
View file

@ -300,7 +300,8 @@ private:
struct ExecutionContext {
NonnullRefPtr<Database> database;
class Statement const* statement;
Statement const* statement { nullptr };
Span<Value const> placeholder_values {};
Tuple* current_row { nullptr };
};
@ -361,6 +362,21 @@ public:
virtual ResultOr<Value> evaluate(ExecutionContext&) const override;
};
class Placeholder : public Expression {
public:
explicit Placeholder(size_t parameter_index)
: m_parameter_index(parameter_index)
{
}
size_t parameter_index() const { return m_parameter_index; }
virtual ResultOr<Value> evaluate(ExecutionContext&) const override;
private:
size_t m_parameter_index { 0 };
};
class NestedExpression : public Expression {
public:
NonnullRefPtr<Expression> const& expression() const { return m_expression; }
@ -729,7 +745,7 @@ private:
class Statement : public ASTNode {
public:
ResultOr<ResultSet> execute(AK::NonnullRefPtr<Database> database) const;
ResultOr<ResultSet> execute(AK::NonnullRefPtr<Database> database, Span<Value const> placeholder_values = {}) const;
virtual ResultOr<ResultSet> execute(ExecutionContext&) const
{