prep for 2.3.928
This commit is contained in:
Sean Corfield
parent
2f1d3ae870
commit
23be700b7e
5 changed files with 8 additions and 8 deletions
|
|
@ -1,6 +1,6 @@
|
|||
# Changes
|
||||
|
||||
* 2.3.next in progress
|
||||
* 2.3.928 in progress
|
||||
* Address [#425](https://github.com/seancorfield/honeysql/issues/425) by clarifying that `INTERVAL` as special syntax may be MySQL-specific and PostgreSQL uses difference syntax (because `INTERVAL` is a data type there).
|
||||
* Address [#423](https://github.com/seancorfield/honeysql/issues/423) by supporting `DEFAULT` values and `DEFAULT` rows in `VALUES`.
|
||||
* Address [#422](https://github.com/seancorfield/honeysql/issues/422) by auto-quoting unusual entity names when `:quoted` (and `:dialect`) are not specified, making HoneySQL more secure by default.
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ SQL as Clojure data structures. Build queries programmatically -- even at runtim
|
|||
|
||||
## Build
|
||||
|
||||
[](https://clojars.org/com.github.seancorfield/honeysql) [](https://cljdoc.org/d/com.github.seancorfield/honeysql/CURRENT)
|
||||
[](https://clojars.org/com.github.seancorfield/honeysql) [](https://cljdoc.org/d/com.github.seancorfield/honeysql/CURRENT)
|
||||
|
||||
This project follows the version scheme MAJOR.MINOR.COMMITS where MAJOR and MINOR provide some relative indication of the size of the change, but do not follow semantic versioning. In general, all changes endeavor to be non-breaking (by moving to new names rather than by breaking existing names). COMMITS is an ever-increasing counter of commits since the beginning of this repository.
|
||||
|
||||
|
|
|
|||
|
|
@ -63,7 +63,7 @@ Supported Clojure versions: 1.7 and later.
|
|||
In `deps.edn`:
|
||||
<!-- :test-doc-blocks/skip -->
|
||||
```clojure
|
||||
com.github.seancorfield/honeysql {:mvn/version "2.3.911"}
|
||||
com.github.seancorfield/honeysql {:mvn/version "2.3.928"}
|
||||
```
|
||||
|
||||
Required as:
|
||||
|
|
|
|||
|
|
@ -10,14 +10,14 @@ For the Clojure CLI, add the following dependency to your `deps.edn` file:
|
|||
|
||||
<!-- :test-doc-blocks/skip -->
|
||||
```clojure
|
||||
com.github.seancorfield/honeysql {:mvn/version "2.3.911"}
|
||||
com.github.seancorfield/honeysql {:mvn/version "2.3.928"}
|
||||
```
|
||||
|
||||
For Leiningen, add the following dependency to your `project.clj` file:
|
||||
|
||||
<!-- :test-doc-blocks/skip -->
|
||||
```clojure
|
||||
[com.github.seancorfield/honeysql "2.3.911"]
|
||||
[com.github.seancorfield/honeysql "2.3.928"]
|
||||
```
|
||||
|
||||
HoneySQL produces SQL statements but does not execute them.
|
||||
|
|
@ -298,7 +298,7 @@ Most databases use `"` for quoting (the `:ansi` and `:oracle` dialects).
|
|||
The `:sqlserver` dialect uses `[`..`]` and the `:mysql` dialect uses
|
||||
```..```. In addition, the `:oracle` dialect disables `AS` in aliases.
|
||||
|
||||
> Note: by default, quoting is **off** which produces cleaner-looking SQL and assumes you control all the symbols/keywords used as table, column, and function names -- the "SQL entities". If you are building any SQL or DDL where the table, column, or function names could be provided by an external source, **you should specify `:quoted true` to ensure all SQL entities are safely quoted**. As of 2.3.next, if you do _not_ specify `:quoted` as an option, HoneySQL will automatically quote any SQL entities that seem unusual, i.e., that contain any characters that are not alphanumeric or underscore. Purely alphanumeric entities will not be quoted (no entities were quoted by default prior to 2.3.next). You can prevent that auto-quoting by explicitly passing `:quoted false` into the `format` call but, from a security point of view, you should think very carefully before you do that: quoting entity names helps protect you from injection attacks!
|
||||
> Note: by default, quoting is **off** which produces cleaner-looking SQL and assumes you control all the symbols/keywords used as table, column, and function names -- the "SQL entities". If you are building any SQL or DDL where the table, column, or function names could be provided by an external source, **you should specify `:quoted true` to ensure all SQL entities are safely quoted**. As of 2.3.928, if you do _not_ specify `:quoted` as an option, HoneySQL will automatically quote any SQL entities that seem unusual, i.e., that contain any characters that are not alphanumeric or underscore. Purely alphanumeric entities will not be quoted (no entities were quoted by default prior to 2.3.928). You can prevent that auto-quoting by explicitly passing `:quoted false` into the `format` call but, from a security point of view, you should think very carefully before you do that: quoting entity names helps protect you from injection attacks!
|
||||
|
||||
Currently, the only dialect that has substantive differences from
|
||||
the others is `:mysql` for which the `:set` clause
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ All options may be omitted. The default behavior of each option is described in
|
|||
* `:dialect` -- a keyword that identifies a dialect to be used for this specific call to `format`; the default is to use what was specified in `set-dialect!` or `:ansi` if no other dialect has been set,
|
||||
* `:inline` -- a Boolean indicating whether or not to inline parameter values, rather than use `?` placeholders and a sequence of parameter values; the default is `false` -- values are not inlined,
|
||||
* `:params` -- a hash map providing values for named parameters, identified by names (keywords or symbols) that start with `?` in the DSL; the default is that any such named parameters will have `nil` values,
|
||||
* `:quoted` -- a Boolean indicating whether or not to quote (strop) SQL entity names (table and column names); the default is `nil` -- alphanumeric SQL entity names are not quoted but (as of 2.3.next) "unusual" SQL entity names are quoted; a `false` value turns off all quoting,
|
||||
* `:quoted` -- a Boolean indicating whether or not to quote (strop) SQL entity names (table and column names); the default is `nil` -- alphanumeric SQL entity names are not quoted but (as of 2.3.928) "unusual" SQL entity names are quoted; a `false` value turns off all quoting,
|
||||
* `:quoted-snake` -- a Boolean indicating whether or not quoted and string SQL entity names should have `-` replaced by `_`; the default is `false` -- quoted and string SQL entity names are left exactly as-is,
|
||||
* `:values-default-columns` -- a sequence of column names that should have `DEFAULT` values instead of `NULL` values if used in a `VALUES` clause with no associated matching value in the hash maps passed in; the default behavior is for such missing columns to be given `NULL` values.
|
||||
|
||||
|
|
@ -118,7 +118,7 @@ The quoting (stropping) is dialect-dependent:
|
|||
* `:oracle` -- uses double quotes
|
||||
* `:sqlserver` -- user square brackets
|
||||
|
||||
As of 2.3.next, if `:quoted` and `:dialect` are not provided, and no
|
||||
As of 2.3.928, if `:quoted` and `:dialect` are not provided, and no
|
||||
default quoting strategy has been specified (via `set-dialect!`) then
|
||||
alphanumeric SQL entity names will not be quoted but "unusual" SQL entity names will
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue