Masterminds / squirrel

Fluent SQL generation for golang
Other
6.88k stars 465 forks source link

Limit and Offset use prepare statement placeholder #355

Open fengxuway opened 1 year ago

fengxuway commented 1 year ago

Can Limit() and Offset() functions make a placeholder for prepare statement?

Use squirrel v1.5.4 the result:

sql, args, err := squirrel.Select("id").From("mytable").Where("id < ?", 100).Limit(10).Offset(20).ToSql()

// output
sql: SELECT id FROM mytable WHERE id < ? LIMIT 10 OFFSET 20
args: [100]

// Expect output
sql: SELECT id FROM mytable WHERE id < ? LIMIT ? OFFSET ?
args: [100, 10, 20]
TrueWill commented 1 year ago

I likewise found this to be unexpected behavior. As those frequently come from query parameters (user input) when implementing pagination, this has security implementations.

In the meantime, a workaround is: Suffix("LIMIT ? OFFSET ?", limit, offset)

dmitriykara commented 3 months ago

Hello! The problem is still present in the latest version of the project.

Could you please let me know if there are any planned actions or timelines for resolving this issue?