Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SQlite dialect escapes single quotes wrong, leads to SQL syntax error #178

Closed
1 of 3 tasks
bilcus opened this issue Nov 3, 2019 · 0 comments
Closed
1 of 3 tasks

Comments

@bilcus
Copy link

bilcus commented Nov 3, 2019

Describe the bug
I didn't have time to do much research but escaping with SQLite does not look right. According to specs, the only thing that needs to be escaped outside of LIKE, GLOB, REGEXP, and MATCH operators are single quotes: ' -> ''. Goqu escapes them wrong ' -> \' and also escapes a lot more then is needed. This leads to bad strings saved to DB or syntax errors in the case of single quotes.

Custom dialect with only these escape runes fixed my issue:

opts.EscapedRunes = map[rune][]byte{
	'\'': []byte("''"),
}

To Reproduce
Add this test to dialect/sqlite3

func (st *sqlite3Suite) TestInsert2() {
	ds := st.db.From("entry")
	now := time.Now()
	e := entry{Int: 10, Float: 1.000000, String: "abc'abc", Time: now, Bool: true, Bytes: []byte("1.000000")}
	_, err := ds.Insert().Rows(e).Executor().Exec()
	st.NoError(err)
}

Output:
Received unexpected error: near "abc": syntax error

Expected behavior
No error.

Dialect:

  • postgres
  • mysql
  • sqlite3
doug-martin added a commit that referenced this issue Dec 7, 2019
* [FIXED] SQlite dialect escapes single quotes wrong, leads to SQL syntax error [#178](#178)
@doug-martin doug-martin added this to the v9.5.1 milestone Dec 7, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants