Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Limit and Offset use prepare statement placeholder #355

Open
fengxuway opened this issue Apr 20, 2023 · 2 comments
Open

Limit and Offset use prepare statement placeholder #355

fengxuway opened this issue Apr 20, 2023 · 2 comments

Comments

@fengxuway
Copy link

fengxuway commented Apr 20, 2023

Can Limit() and Offset() functions make a placeholder for prepare statement?

Use squirrel v1.5.4 the result:

sql, args, err := squirrel.Select("id").From("mytable").Where("id < ?", 100).Limit(10).Offset(20).ToSql()

// output
sql: SELECT id FROM mytable WHERE id < ? LIMIT 10 OFFSET 20
args: [100]

// Expect output
sql: SELECT id FROM mytable WHERE id < ? LIMIT ? OFFSET ?
args: [100, 10, 20]
@TrueWill
Copy link

TrueWill commented Jun 8, 2023

I likewise found this to be unexpected behavior. As those frequently come from query parameters (user input) when implementing pagination, this has security implementations.

In the meantime, a workaround is: Suffix("LIMIT ? OFFSET ?", limit, offset)

@dmitriykara
Copy link

Hello! The problem is still present in the latest version of the project.

Could you please let me know if there are any planned actions or timelines for resolving this issue?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants