luciano/next-jdbc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fixes #296 by adding sql-params validation

Browse source 
Signed-off-by: Sean Corfield <sean@corfield.org>
This commit is contained in:
Sean Corfield 2025-02-22 15:02:05 -08:00
parent 75dab5d843
commit c89744b05f
No known key found for this signature in database
1 changed files with 30 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
src/next/jdbc.clj
View file

@ -177,6 +177,14 @@
[spec user password opts] [spec user password opts]
(p/get-connection spec (assoc opts :user user :password password)))) (p/get-connection spec (assoc opts :user user :password password))))
(defn- ensure-sql-params [sql-params]
(when-not (or (nil? sql-params)
(and (seqable? sql-params)
(or (empty? sql-params)
(string? (first sql-params)))))
(throw (ex-info "sql-params should be a vector containing a SQL string and any parameters"
{:sql-params sql-params}))))
(defn prepare (defn prepare
"Given a connection to a database, and a vector containing SQL and any "Given a connection to a database, and a vector containing SQL and any
parameters it needs, return a new `PreparedStatement`. parameters it needs, return a new `PreparedStatement`.
@ -191,11 +199,13 @@
See the list of options above (in the namespace docstring) for what can See the list of options above (in the namespace docstring) for what can
be passed to prepare." be passed to prepare."
(^java.sql.PreparedStatement (^java.sql.PreparedStatement
[connection sql-params] [connection sql-params]
(p/prepare connection sql-params {})) (ensure-sql-params sql-params)
(p/prepare connection sql-params {}))
(^java.sql.PreparedStatement (^java.sql.PreparedStatement
[connection sql-params opts] [connection sql-params opts]
(p/prepare connection sql-params opts))) (ensure-sql-params sql-params)
(p/prepare connection sql-params opts)))
(defn plan (defn plan
"General SQL execution function (for working with result sets). "General SQL execution function (for working with result sets).
@ -228,16 +238,18 @@
(or they can be different, depending on how you want the row to be built, (or they can be different, depending on how you want the row to be built,
and how you want any subsequent lazy navigation to be handled)." and how you want any subsequent lazy navigation to be handled)."
(^clojure.lang.IReduceInit (^clojure.lang.IReduceInit
[stmt] [stmt]
(p/-execute stmt [] {})) (p/-execute stmt [] {}))
(^clojure.lang.IReduceInit (^clojure.lang.IReduceInit
[connectable sql-params] [connectable sql-params]
(p/-execute connectable sql-params (ensure-sql-params sql-params)
{:next.jdbc/sql-params sql-params})) (p/-execute connectable sql-params
{:next.jdbc/sql-params sql-params}))
(^clojure.lang.IReduceInit (^clojure.lang.IReduceInit
[connectable sql-params opts] [connectable sql-params opts]
(p/-execute connectable sql-params (ensure-sql-params sql-params)
(assoc opts :next.jdbc/sql-params sql-params)))) (p/-execute connectable sql-params
(assoc opts :next.jdbc/sql-params sql-params))))
(defn execute! (defn execute!
"General SQL execution function. "General SQL execution function.
@ -252,9 +264,11 @@
([stmt] ([stmt]
(p/-execute-all stmt [] {})) (p/-execute-all stmt [] {}))
([connectable sql-params] ([connectable sql-params]
(ensure-sql-params sql-params)
(p/-execute-all connectable sql-params (p/-execute-all connectable sql-params
{:next.jdbc/sql-params sql-params})) {:next.jdbc/sql-params sql-params}))
([connectable sql-params opts] ([connectable sql-params opts]
(ensure-sql-params sql-params)
(p/-execute-all connectable sql-params (p/-execute-all connectable sql-params
(assoc opts :next.jdbc/sql-params sql-params)))) (assoc opts :next.jdbc/sql-params sql-params))))
@ -271,9 +285,11 @@
([stmt] ([stmt]
(p/-execute-one stmt [] {})) (p/-execute-one stmt [] {}))
([connectable sql-params] ([connectable sql-params]
(ensure-sql-params sql-params)
(p/-execute-one connectable sql-params (p/-execute-one connectable sql-params
{:next.jdbc/sql-params sql-params})) {:next.jdbc/sql-params sql-params}))
([connectable sql-params opts] ([connectable sql-params opts]
(ensure-sql-params sql-params)
(p/-execute-one connectable sql-params (p/-execute-one connectable sql-params
(assoc opts :next.jdbc/sql-params sql-params)))) (assoc opts :next.jdbc/sql-params sql-params))))
@ -336,6 +352,8 @@
result)))) result))))
params))) params)))
([connectable sql param-groups opts] ([connectable sql param-groups opts]
(when-not (string? sql)
(throw (IllegalArgumentException. "execute-batch! requires a SQL string")))
(if (instance? java.sql.Connection (p/unwrap connectable)) (if (instance? java.sql.Connection (p/unwrap connectable))
(with-open [ps (prepare connectable [sql] opts)] (with-open [ps (prepare connectable [sql] opts)]
(execute-batch! ps param-groups opts)) (execute-batch! ps param-groups opts))