/
githubmirror
/
photoprism
Обзор
Документация
Войти
/
githubmirror
/
photoprism
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
develop
pkg/clean/sql.go
87 строк
2 KB
Michael Mayer
Search: Use parameterized queries for user search input #5587
17 май 2026, 16:46
17 май 2026, 16:46
8522146
Код
Авторство
О чём код?
package clean // SqlSpecial checks if the byte must be escaped/omitted in SQL. func SqlSpecial(b byte) (special bool, omit bool) { if b < 32 { return true, true } switch b { case '"', '\'', '\\': return true, false default: return false, false } } // SqlString escapes a string for use in an SQL query. func SqlString(s string) string { var i int for i = 0; i < len(s); i++ { if found, _ := SqlSpecial(s[i]); found { break } } // Return if no special characters were found. if i >= len(s) { return s } b := make([]byte, 2*len(s)-i) copy(b, s[:i]) j := i for ; i < len(s); i++ { if special, omit := SqlSpecial(s[i]); omit { // Omit control characters. continue } else if special { // Escape other special characters. // see https://mariadb.com/kb/en/string-literals/ b[j] = s[i] j++ } b[j] = s[i] j++ } return string(b[:j]) } // SqlClean strips bytes that must be omitted from an SQL parameter value // (currently control characters below 0x20). Quote characters are preserved // unchanged because the caller is expected to pass the result through a // parameterized query, where escaping is the driver's responsibility. func SqlClean(s string) string { var i int for i = 0; i < len(s); i++ { if _, omit := SqlSpecial(s[i]); omit { break } } // Return unchanged if no omittable characters were found. if i >= len(s) { return s } b := make([]byte, len(s)) copy(b, s[:i]) j := i for ; i < len(s); i++ { if _, omit := SqlSpecial(s[i]); omit { continue } b[j] = s[i] j++ } return string(b[:j]) }