mirror of
https://github.com/RGBCube/serenity
synced 2025-05-16 19:55:06 +00:00
LibSQL: Parse and execute sequential placeholder values
This partially implements SQLite's bind-parameter expression to support indicating placeholder values in a SQL statement. For example: INSERT INTO table VALUES (42, ?); In the above statement, the '?' identifier is a placeholder. This will allow clients to compile statements a single time while running those statements any number of times with different placeholder values. Further, this will help mitigate SQL injection attacks.
This commit is contained in:
parent
53f8d62ea4
commit
b2b9ae27fd
10 changed files with 154 additions and 30 deletions
|
@ -29,6 +29,13 @@ ResultOr<Value> NullLiteral::evaluate(ExecutionContext&) const
|
|||
return Value {};
|
||||
}
|
||||
|
||||
ResultOr<Value> Placeholder::evaluate(ExecutionContext& context) const
|
||||
{
|
||||
if (parameter_index() >= context.placeholder_values.size())
|
||||
return Result { SQLCommand::Unknown, SQLErrorCode::InvalidNumberOfPlaceholderValues };
|
||||
return context.placeholder_values[parameter_index()];
|
||||
}
|
||||
|
||||
ResultOr<Value> NestedExpression::evaluate(ExecutionContext& context) const
|
||||
{
|
||||
return expression()->evaluate(context);
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue