kysely: Alarming error output sql
Apologies, I am probably doing something horribly wrong. Inserts are failing with
code: 'ER_PARSE_ERROR',
errno: 1064,
sqlState: '42000',
sqlMessage: "You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '' at line 1",
Confused, I pasted the code into an SQL editor, and found that syntax highlighting was also broken. It breaks
'<p>Omie,</p><p>We aren\\'t in contact
^^
here
And the problem becomes obvious! Single quotes are being escaped like \\', when really they ought to be like ''.
I’m unclear where this escaping code is even coming from. I did a search for escape and found nothing. Interestingly, Connection.escape(value: any): string is also escaping in a faulty way:
'<p>Omie,</p><p>We aren\'t in contact
So it’s pretty unclear to me if this issue is coming from kysely or mysql2. I was hoping you could provide some insight.
Some other things
- Regardless of the source of the problem, it’s very concerning. Will a deliberate, more sophisticated attack be handled?
- I can’t escape manually, I tried and it just results in exponential
\\\\\\\\\
About this issue
- Original URL
- State: closed
- Created 2 years ago
- Comments: 15 (9 by maintainers)
There’s no way or need to do that. Thanks for the offer though 😊
Thank you! Sorry for that whole roller coaster. Is there some way I could buy you a coffee?