On Thu, Jun 30, 2011 at 3:19 PM, Ben Rosenberg <brosenberg@imvu.com> wrote:
Show quoted text> On Wed, Jun 29, 2011 at 3:06 PM,
http://emazep.myopenid.com/ via RT <
> bug-SQL-SplitStatement@rt.cpan.org> wrote:
>
>> <URL:
https://rt.cpan.org/Ticket/Display.html?id=69153 >
>>
>> On Tue Jun 28 13:53:28 2011, brosenberg@imvu.com wrote:
>>
>> > Hi,
>> >
>> > I found that using SQL::SplitStatement will remove quotes from some
>> > statements, making the syntax invalid. I am using version 1.00020 of the
>> > module.
>> > Below is an example of where quotes are removed to create an invalid
>> > statement.
>> >
>> > #!/usr/bin/perl
>> >
>> > use strict;
>> > use warnings;
>> > use SQL::SplitStatement;
>> >
>> > my $sql_splitter = SQL::SplitStatement->new;
>> > my $stmt = "INSERT INTO example_table (user_id, sample_data) VALUES
>> (1234,
>> > \'single statement\\\\\\\\\')";
>> > for ( $sql_splitter->split($stmt) ) {
>> > print "$_\n";
>> > }
>> >
>> >
>> > Thanks,
>> > Ben Rosenberg
>>
>> First of all, thanks for your report!
>>
>> This an SQL::Tokenizer problem (which is used by SQL::SplitStatement),
>> which means that is probably time for SQL::SplitStatement to have its
>> own lexer, which however will require some more time.
>>
>> In the meantime, I would be very grateful if you could send an example
>> of a *working* and *complete* statement (also please specifying the DBMS
>> you are referring to) which is turned by SQL::SplitStatement into an
>> unusable one.
>>
>> Thanks again!
>>
>> -Emanuele
>>
>
> Hi!
> So a coworker of mine fixed the problem in SQL::Tokenizer, and is going to
> submit a patch for that module. So hopefully this should be fixed.
>
> Thanks,
> Ben
>
If you're curious, here's the patch:
diff -urN libsql-tokenizer-perl-0.22.orig/lib/SQL/Tokenizer.pm
libsql-tokenizer-perl-0.22/lib/SQL/Tokenizer.pm
--- libsql-tokenizer-perl-0.22.orig/lib/SQL/Tokenizer.pm 2011-03-23
23:39:05.000000000 -0700
+++ libsql-tokenizer-perl-0.22/lib/SQL/Tokenizer.pm 2011-06-30
15:23:41.220210780 -0700
@@ -11,7 +11,7 @@
our @EXPORT_OK= qw(tokenize_sql);
-our $VERSION= '0.22';
+our $VERSION= '0.220001';
my $re= qr{
(
@@ -26,13 +26,13 @@
|
\"\"(?!\"") # empty double quoted string
|
- ".*?(?:(?:""){1,}"|(?<!["\\])"(?!")|\\"{2})
+ "(?:""|\\.|[^"\\])*"
# anything inside double quotes, ungreedy
- |
- `.*?(?:(?:``){1,}`|(?<![`\\])`(?!`)|\\`{2})
+ |
+ `(?:``|\\.|[^`\\])*`
# anything inside backticks quotes,
ungreedy
|
- '.*?(?:(?:''){1,}'|(?<!['\\])'(?!')|\\'{2})
+ '(?:''|\\.|[^'\\])*'
# anything inside single quotes, ungreedy.
|
/\*[\ \t\r\n\S]*?\*/ # C style comments
diff -urN libsql-tokenizer-perl-0.22.orig/t/01-single-quotes.t
libsql-tokenizer-perl-0.22/t/01-single-quotes.t
--- libsql-tokenizer-perl-0.22.orig/t/01-single-quotes.t 2011-03-21
01:12:25.000000000 -0700
+++ libsql-tokenizer-perl-0.22/t/01-single-quotes.t 2011-06-30
15:21:21.028912601 -0700
@@ -50,6 +50,21 @@
},
{
+ description => qq{more than one C style escaped single quotes
inside string, with extra backslashes},
+ query =>
+ q{INSERT INTO logs (program, message) VALUES (:program,
'Something \' with \' a \' lot \' of \' scaped quotes\\\\\\\\\\\\\\\\')}
,
+ wanted => [
+ 'INSERT', SPACE, 'INTO', SPACE,
+ 'logs', SPACE, '(', 'program',
+ COMMA, SPACE, 'message', ')',
+ SPACE, 'VALUES', SPACE, '(',
+ ':program', COMMA, SPACE,
+ q{'Something \' with \' a \' lot \' of \' scaped
quotes\\\\\\\\\\\\\\\\'},
+ ')'
+ ],
+ },
+
+ {
description => qq{SQL style escaped single quotes},
query => q{INSERT INTO logs (program) VALUES
('single''quote')},
wanted => [
