Help us shape the future of Go! Take the 2026 Go Developer Survey

sqlscan

package
v0.30.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 19, 2026 License: MIT Imports: 1 Imported by: 0

Documentation

Overview

Package sqlscan finds the "?" bind placeholders of a SQL statement, skipping string literals, quoted identifiers and comments the way the target dialect lexes them. database.Rebind and the orm's WhereRaw check share it, so counting placeholders and renumbering them cannot disagree.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type Result

type Result struct {
	// SQL is the statement with every placeholder replaced by the
	// placeholder function's output (and, on PostgreSQL, "??" by "?").
	SQL string
	// Placeholders is the number of "?" bind placeholders found.
	Placeholders int
	// DollarParams counts explicit PostgreSQL "$n" parameters outside
	// literals, comments and dollar-quoted bodies. Mixed with "?" they
	// would bind the wrong values, so callers that renumber reject them.
	DollarParams int
	// Terminated is false when the statement ends inside a literal, a quoted
	// identifier, a comment (a "--" comment needs its newline) or a
	// dollar-quoted body: a fragment like that would swallow whatever SQL
	// is appended after it.
	Terminated bool
}

Result is the outcome of Scan.

func Scan

func Scan(dialect, query string, ph func(n int) string) Result

Scan walks query as dialect ("postgres", "mysql", "sqlite") lexes it; any other name, including "", lexes like SQLite. ph renders the n-th (1-based) placeholder; nil keeps "?".

Every dialect skips '…' literals, "…" quoted text, "--" line comments and /* */ block comments. PostgreSQL adds E'…' backslash escapes, nested block comments, $tag$…$tag$ bodies and "??" as a literal "?" (jsonb operators). MySQL adds `…` identifiers, backslash escapes in quoted strings, "#" comments, and needs a space, tab or newline after "--" for a comment ("a--1" is a minus a minus). SQLite adds `…` and […] identifiers. Outside PostgreSQL "??" is two placeholders.

It assumes the servers' default lexing: standard_conforming_strings on (PostgreSQL), no ANSI_QUOTES or NO_BACKSLASH_ESCAPES (MySQL). MySQL runs the contents of /*! */ and /*+ */ comments, but Scan skips them like any comment, so placeholders there are not supported.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL