From 265a56630b41c70fe0ae8c0dd9707de3c43f446d Mon Sep 17 00:00:00 2001 From: CommanderRoot Date: Sun, 1 Jan 2023 14:06:41 +0100 Subject: filer.store.mysql: Escape table columns in SQL query (#4095) --- weed/filer/mysql/mysql_sql_gen.go | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) (limited to 'weed/filer/mysql/mysql_sql_gen.go') diff --git a/weed/filer/mysql/mysql_sql_gen.go b/weed/filer/mysql/mysql_sql_gen.go index 3b0fc940e..d2fffc4c1 100644 --- a/weed/filer/mysql/mysql_sql_gen.go +++ b/weed/filer/mysql/mysql_sql_gen.go @@ -21,32 +21,32 @@ func (gen *SqlGenMysql) GetSqlInsert(tableName string) string { if gen.UpsertQueryTemplate != "" { return fmt.Sprintf(gen.UpsertQueryTemplate, tableName) } else { - return fmt.Sprintf("INSERT INTO `%s` (dirhash,name,directory,meta) VALUES(?,?,?,?)", tableName) + return fmt.Sprintf("INSERT INTO `%s` (`dirhash`,`name`,`directory`,`meta`) VALUES(?,?,?,?)", tableName) } } func (gen *SqlGenMysql) GetSqlUpdate(tableName string) string { - return fmt.Sprintf("UPDATE `%s` SET meta=? WHERE dirhash=? AND name=? AND directory=?", tableName) + return fmt.Sprintf("UPDATE `%s` SET `meta` = ? WHERE `dirhash` = ? AND `name` = ? AND `directory` = ?", tableName) } func (gen *SqlGenMysql) GetSqlFind(tableName string) string { - return fmt.Sprintf("SELECT meta FROM `%s` WHERE dirhash=? AND name=? AND directory=?", tableName) + return fmt.Sprintf("SELECT `meta` FROM `%s` WHERE `dirhash` = ? AND `name = ? AND `directory` = ?", tableName) } func (gen *SqlGenMysql) GetSqlDelete(tableName string) string { - return fmt.Sprintf("DELETE FROM `%s` WHERE dirhash=? AND name=? AND directory=?", tableName) + return fmt.Sprintf("DELETE FROM `%s` WHERE `dirhash` = ? AND `name` = ? AND `directory` = ?", tableName) } func (gen *SqlGenMysql) GetSqlDeleteFolderChildren(tableName string) string { - return fmt.Sprintf("DELETE FROM `%s` WHERE dirhash=? AND directory=?", tableName) + return fmt.Sprintf("DELETE FROM `%s` WHERE `dirhash` = ? AND `directory` = ?", tableName) } func (gen *SqlGenMysql) GetSqlListExclusive(tableName string) string { - return fmt.Sprintf("SELECT NAME, meta FROM `%s` WHERE dirhash=? AND name>? AND directory=? AND name like ? ORDER BY NAME ASC LIMIT ?", tableName) + return fmt.Sprintf("SELECT `name`, `meta` FROM `%s` WHERE `dirhash` = ? AND `name` > ? AND `directory` = ? AND `name` LIKE ? ORDER BY `name` ASC LIMIT ?", tableName) } func (gen *SqlGenMysql) GetSqlListInclusive(tableName string) string { - return fmt.Sprintf("SELECT NAME, meta FROM `%s` WHERE dirhash=? AND name>=? AND directory=? AND name like ? ORDER BY NAME ASC LIMIT ?", tableName) + return fmt.Sprintf("SELECT `name`, `meta` FROM `%s` WHERE `dirhash` = ? AND `name` >= ? AND `directory` = ? AND `name` LIKE ? ORDER BY `name` ASC LIMIT ?", tableName) } func (gen *SqlGenMysql) GetSqlCreateTable(tableName string) string { -- cgit v1.2.3