search

dinedal / textql

Execute SQL against structured text like CSV or TSV
MIT License
9.06k stars 300 forks source link

Magic "short SQL" syntax does not escape table name #79

Closed vovcacik closed 6 years ago

vovcacik commented 6 years ago

Hi, I have noticed that you escape table names with square brackets, e.g. [tableName]. However you probably forgot to do so in the code that handles the magic/short SQL syntax. This results in SQL query with unescaped table name.

textql version: commit 01160a69ae3b9ea1258f979093c39ed6b59c8b46 OS: Windows 10

Example use case where it can cause trouble:

# short SQL will fail
C:\textql>textql -sql "*" test.txt
2018/04/13 16:09:20 unrecognized token: ":"

# this is equivalent of the above (yes, the table name is full path without extension)
C:\textql>textql -sql "select * from C:\textql\test" test.txt
2018/04/13 16:09:28 unrecognized token: ":"

# escaping the table name helps
C:\textql>textql -sql "select * from [C:\textql\test]" test.txt
foo,bar