mirror of
https://github.com/RGBCube/serenity
synced 2025-10-31 07:02:44 +00:00
b2b9ae27fd
This partially implements SQLite's bind-parameter expression to support
indicating placeholder values in a SQL statement. For example:
INSERT INTO table VALUES (42, ?);
In the above statement, the '?' identifier is a placeholder. This will
allow clients to compile statements a single time while running those
statements any number of times with different placeholder values.
Further, this will help mitigate SQL injection attacks.
25 lines
639 B
C++
25 lines
639 B
C++
/*
|
|
* Copyright (c) 2021, Jan de Visser <jan@de-visser.net>
|
|
*
|
|
* SPDX-License-Identifier: BSD-2-Clause
|
|
*/
|
|
|
|
#include <LibSQL/AST/AST.h>
|
|
#include <LibSQL/Database.h>
|
|
#include <LibSQL/Meta.h>
|
|
#include <LibSQL/Row.h>
|
|
|
|
namespace SQL::AST {
|
|
|
|
ResultOr<ResultSet> Statement::execute(AK::NonnullRefPtr<Database> database, Span<Value const> placeholder_values) const
|
|
{
|
|
ExecutionContext context { move(database), this, placeholder_values, nullptr };
|
|
auto result = TRY(execute(context));
|
|
|
|
// FIXME: When transactional sessions are supported, don't auto-commit modifications.
|
|
TRY(context.database->commit());
|
|
|
|
return result;
|
|
}
|
|
|
|
}
|