diff --git a/CHANGELOG.md b/CHANGELOG.md index 7422775..a863fb9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # Changes -* 2.3.next in progress +* 2.3.928 in progress * Address [#425](https://github.com/seancorfield/honeysql/issues/425) by clarifying that `INTERVAL` as special syntax may be MySQL-specific and PostgreSQL uses difference syntax (because `INTERVAL` is a data type there). * Address [#423](https://github.com/seancorfield/honeysql/issues/423) by supporting `DEFAULT` values and `DEFAULT` rows in `VALUES`. * Address [#422](https://github.com/seancorfield/honeysql/issues/422) by auto-quoting unusual entity names when `:quoted` (and `:dialect`) are not specified, making HoneySQL more secure by default. diff --git a/README.md b/README.md index cc2188f..b420348 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ SQL as Clojure data structures. Build queries programmatically -- even at runtim ## Build -[![Clojars Project](https://clojars.org/com.github.seancorfield/honeysql/latest-version.svg)](https://clojars.org/com.github.seancorfield/honeysql) [![cljdoc badge](https://cljdoc.org/badge/com.github.seancorfield/honeysql?2.3.911)](https://cljdoc.org/d/com.github.seancorfield/honeysql/CURRENT) +[![Clojars Project](https://clojars.org/com.github.seancorfield/honeysql/latest-version.svg)](https://clojars.org/com.github.seancorfield/honeysql) [![cljdoc badge](https://cljdoc.org/badge/com.github.seancorfield/honeysql?2.3.928)](https://cljdoc.org/d/com.github.seancorfield/honeysql/CURRENT) This project follows the version scheme MAJOR.MINOR.COMMITS where MAJOR and MINOR provide some relative indication of the size of the change, but do not follow semantic versioning. In general, all changes endeavor to be non-breaking (by moving to new names rather than by breaking existing names). COMMITS is an ever-increasing counter of commits since the beginning of this repository. diff --git a/doc/differences-from-1-x.md b/doc/differences-from-1-x.md index a06efca..37cfca7 100644 --- a/doc/differences-from-1-x.md +++ b/doc/differences-from-1-x.md @@ -63,7 +63,7 @@ Supported Clojure versions: 1.7 and later. In `deps.edn`: ```clojure -com.github.seancorfield/honeysql {:mvn/version "2.3.911"} +com.github.seancorfield/honeysql {:mvn/version "2.3.928"} ``` Required as: diff --git a/doc/getting-started.md b/doc/getting-started.md index dd0e1a0..a74918f 100644 --- a/doc/getting-started.md +++ b/doc/getting-started.md @@ -10,14 +10,14 @@ For the Clojure CLI, add the following dependency to your `deps.edn` file: ```clojure - com.github.seancorfield/honeysql {:mvn/version "2.3.911"} + com.github.seancorfield/honeysql {:mvn/version "2.3.928"} ``` For Leiningen, add the following dependency to your `project.clj` file: ```clojure - [com.github.seancorfield/honeysql "2.3.911"] + [com.github.seancorfield/honeysql "2.3.928"] ``` HoneySQL produces SQL statements but does not execute them. @@ -298,7 +298,7 @@ Most databases use `"` for quoting (the `:ansi` and `:oracle` dialects). The `:sqlserver` dialect uses `[`..`]` and the `:mysql` dialect uses ```..```. In addition, the `:oracle` dialect disables `AS` in aliases. -> Note: by default, quoting is **off** which produces cleaner-looking SQL and assumes you control all the symbols/keywords used as table, column, and function names -- the "SQL entities". If you are building any SQL or DDL where the table, column, or function names could be provided by an external source, **you should specify `:quoted true` to ensure all SQL entities are safely quoted**. As of 2.3.next, if you do _not_ specify `:quoted` as an option, HoneySQL will automatically quote any SQL entities that seem unusual, i.e., that contain any characters that are not alphanumeric or underscore. Purely alphanumeric entities will not be quoted (no entities were quoted by default prior to 2.3.next). You can prevent that auto-quoting by explicitly passing `:quoted false` into the `format` call but, from a security point of view, you should think very carefully before you do that: quoting entity names helps protect you from injection attacks! +> Note: by default, quoting is **off** which produces cleaner-looking SQL and assumes you control all the symbols/keywords used as table, column, and function names -- the "SQL entities". If you are building any SQL or DDL where the table, column, or function names could be provided by an external source, **you should specify `:quoted true` to ensure all SQL entities are safely quoted**. As of 2.3.928, if you do _not_ specify `:quoted` as an option, HoneySQL will automatically quote any SQL entities that seem unusual, i.e., that contain any characters that are not alphanumeric or underscore. Purely alphanumeric entities will not be quoted (no entities were quoted by default prior to 2.3.928). You can prevent that auto-quoting by explicitly passing `:quoted false` into the `format` call but, from a security point of view, you should think very carefully before you do that: quoting entity names helps protect you from injection attacks! Currently, the only dialect that has substantive differences from the others is `:mysql` for which the `:set` clause diff --git a/doc/options.md b/doc/options.md index fb9460d..9b32809 100644 --- a/doc/options.md +++ b/doc/options.md @@ -20,7 +20,7 @@ All options may be omitted. The default behavior of each option is described in * `:dialect` -- a keyword that identifies a dialect to be used for this specific call to `format`; the default is to use what was specified in `set-dialect!` or `:ansi` if no other dialect has been set, * `:inline` -- a Boolean indicating whether or not to inline parameter values, rather than use `?` placeholders and a sequence of parameter values; the default is `false` -- values are not inlined, * `:params` -- a hash map providing values for named parameters, identified by names (keywords or symbols) that start with `?` in the DSL; the default is that any such named parameters will have `nil` values, -* `:quoted` -- a Boolean indicating whether or not to quote (strop) SQL entity names (table and column names); the default is `nil` -- alphanumeric SQL entity names are not quoted but (as of 2.3.next) "unusual" SQL entity names are quoted; a `false` value turns off all quoting, +* `:quoted` -- a Boolean indicating whether or not to quote (strop) SQL entity names (table and column names); the default is `nil` -- alphanumeric SQL entity names are not quoted but (as of 2.3.928) "unusual" SQL entity names are quoted; a `false` value turns off all quoting, * `:quoted-snake` -- a Boolean indicating whether or not quoted and string SQL entity names should have `-` replaced by `_`; the default is `false` -- quoted and string SQL entity names are left exactly as-is, * `:values-default-columns` -- a sequence of column names that should have `DEFAULT` values instead of `NULL` values if used in a `VALUES` clause with no associated matching value in the hash maps passed in; the default behavior is for such missing columns to be given `NULL` values. @@ -118,7 +118,7 @@ The quoting (stropping) is dialect-dependent: * `:oracle` -- uses double quotes * `:sqlserver` -- user square brackets -As of 2.3.next, if `:quoted` and `:dialect` are not provided, and no +As of 2.3.928, if `:quoted` and `:dialect` are not provided, and no default quoting strategy has been specified (via `set-dialect!`) then alphanumeric SQL entity names will not be quoted but "unusual" SQL entity names will