From 265a56630b41c70fe0ae8c0dd9707de3c43f446d Mon Sep 17 00:00:00 2001 From: CommanderRoot Date: Sun, 1 Jan 2023 14:06:41 +0100 Subject: [PATCH] filer.store.mysql: Escape table columns in SQL query (#4095) --- weed/filer/mysql/mysql_sql_gen.go | 14 +++++++------- weed/filer/mysql/mysql_store.go | 2 +- weed/filer/mysql2/mysql2_store.go | 2 +- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/weed/filer/mysql/mysql_sql_gen.go b/weed/filer/mysql/mysql_sql_gen.go index 3b0fc940e..d2fffc4c1 100644 --- a/weed/filer/mysql/mysql_sql_gen.go +++ b/weed/filer/mysql/mysql_sql_gen.go @@ -21,32 +21,32 @@ func (gen *SqlGenMysql) GetSqlInsert(tableName string) string { if gen.UpsertQueryTemplate != "" { return fmt.Sprintf(gen.UpsertQueryTemplate, tableName) } else { - return fmt.Sprintf("INSERT INTO `%s` (dirhash,name,directory,meta) VALUES(?,?,?,?)", tableName) + return fmt.Sprintf("INSERT INTO `%s` (`dirhash`,`name`,`directory`,`meta`) VALUES(?,?,?,?)", tableName) } } func (gen *SqlGenMysql) GetSqlUpdate(tableName string) string { - return fmt.Sprintf("UPDATE `%s` SET meta=? WHERE dirhash=? AND name=? AND directory=?", tableName) + return fmt.Sprintf("UPDATE `%s` SET `meta` = ? WHERE `dirhash` = ? AND `name` = ? AND `directory` = ?", tableName) } func (gen *SqlGenMysql) GetSqlFind(tableName string) string { - return fmt.Sprintf("SELECT meta FROM `%s` WHERE dirhash=? AND name=? AND directory=?", tableName) + return fmt.Sprintf("SELECT `meta` FROM `%s` WHERE `dirhash` = ? AND `name = ? AND `directory` = ?", tableName) } func (gen *SqlGenMysql) GetSqlDelete(tableName string) string { - return fmt.Sprintf("DELETE FROM `%s` WHERE dirhash=? AND name=? AND directory=?", tableName) + return fmt.Sprintf("DELETE FROM `%s` WHERE `dirhash` = ? AND `name` = ? AND `directory` = ?", tableName) } func (gen *SqlGenMysql) GetSqlDeleteFolderChildren(tableName string) string { - return fmt.Sprintf("DELETE FROM `%s` WHERE dirhash=? AND directory=?", tableName) + return fmt.Sprintf("DELETE FROM `%s` WHERE `dirhash` = ? AND `directory` = ?", tableName) } func (gen *SqlGenMysql) GetSqlListExclusive(tableName string) string { - return fmt.Sprintf("SELECT NAME, meta FROM `%s` WHERE dirhash=? AND name>? AND directory=? AND name like ? ORDER BY NAME ASC LIMIT ?", tableName) + return fmt.Sprintf("SELECT `name`, `meta` FROM `%s` WHERE `dirhash` = ? AND `name` > ? AND `directory` = ? AND `name` LIKE ? ORDER BY `name` ASC LIMIT ?", tableName) } func (gen *SqlGenMysql) GetSqlListInclusive(tableName string) string { - return fmt.Sprintf("SELECT NAME, meta FROM `%s` WHERE dirhash=? AND name>=? AND directory=? AND name like ? ORDER BY NAME ASC LIMIT ?", tableName) + return fmt.Sprintf("SELECT `name`, `meta` FROM `%s` WHERE `dirhash` = ? AND `name` >= ? AND `directory` = ? AND `name` LIKE ? ORDER BY `name` ASC LIMIT ?", tableName) } func (gen *SqlGenMysql) GetSqlCreateTable(tableName string) string { diff --git a/weed/filer/mysql/mysql_store.go b/weed/filer/mysql/mysql_store.go index 97e066ce3..ea40373d9 100644 --- a/weed/filer/mysql/mysql_store.go +++ b/weed/filer/mysql/mysql_store.go @@ -53,7 +53,7 @@ func (store *MysqlStore) initialize(upsertQuery string, enableUpsert bool, user, } store.SqlGenerator = &SqlGenMysql{ CreateTableSqlTemplate: "", - DropTableSqlTemplate: "drop table `%s`", + DropTableSqlTemplate: "DROP TABLE `%s`", UpsertQueryTemplate: upsertQuery, } diff --git a/weed/filer/mysql2/mysql2_store.go b/weed/filer/mysql2/mysql2_store.go index 6d4229580..7008de171 100644 --- a/weed/filer/mysql2/mysql2_store.go +++ b/weed/filer/mysql2/mysql2_store.go @@ -58,7 +58,7 @@ func (store *MysqlStore2) initialize(createTable, upsertQuery string, enableUpse } store.SqlGenerator = &mysql.SqlGenMysql{ CreateTableSqlTemplate: createTable, - DropTableSqlTemplate: "drop table `%s`", + DropTableSqlTemplate: "DROP TABLE `%s`", UpsertQueryTemplate: upsertQuery, }