DapperLib / DapperAOT

Build time tools in the flavor of Dapper
Other
357 stars 19 forks source link

Ensure parameter false positives are detected #60

Closed mgravell closed 2 months ago

mgravell commented 11 months ago

See https://github.com/DapperLib/Dapper/issues/1914 and https://github.com/DapperLib/Dapper/issues/1971

In analyzer mode (not in generator mode), we should be able to detect the following queries as problematic, i.e. the true parameters are not the same as Dapper is going to assume:

select 'this ? looks like OLE DB'

and

select 'this ?looks? like pseudo-positional

The problem here is that the runtime SQL parser in Dapper detects both of these as meaning the wrong thing; they aren't parameters. Our existing parameter handler in TSQL should be able to detect this.