search

microsoft / go-sqlcmd

The new sqlcmd, CLI for SQL Server and Azure SQL (winget install sqlcmd / sqlcmd create mssql / sqlcmd open ads)
https://learn.microsoft.com/sql/tools/sqlcmd/go-sqlcmd-utility
MIT License
334 stars 58 forks source link

Variable substitution not disabled when using -x #541

Closed grothwell closed 1 month ago

grothwell commented 1 month ago

In go-sqlcmd 1.7.0 the -x parameter doesn't appear to be working and leads to an error. Running the same script using ODBC sqlcmd works properly.

testsql.sql contents: SELECT '$('

Example command usage: sqlcmd -i testsql.sql -x

Example output when not working: Sqlcmd: Error: Syntax error at line 1

shueybubbles commented 1 month ago

thx for opening the issue! I suspect we only check -x after finding variable placeholders instead of skipping the variable scan altogether.

grothwell commented 1 month ago

I did a quick local check and found DisableVariableSubstitution was being set to true when -x was present. The bug is likely in the implementation of how DisableVariableSubstitution is used. I did not trace it any further than that.

As far as I could tell there is no escape character for $(. My work around is to do character substitution in the script before running sqlcmd to avoid the error caused by sqlcmd finding $( in the sql script.

My actual case is a script that is inserting Javascript in the field of a table. I simplified the example in my issue report.

shueybubbles commented 1 month ago

try 1.8

thx!