Documentation
¶
Overview ¶
Package sqlredact turns a SQL statement into its shape: every string and number literal replaced by ?, comments dropped, whitespace collapsed, control bytes escaped. It is the one masker behind the db.query.text attribute core/tracing puts on SQL spans and the sql attr of framework/slowquery's slow-query line, so a fix to how one engine quotes text reaches both.
Where a literal ends depends on the engine, so the caller names it. Unknown reads the statement under every engine's rules at once and masks whatever any of them reads as a literal: it may hide an identifier, never a value.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Text ¶
Text is query with its literals replaced by ?, comments dropped and whitespace collapsed: 'single-quoted' strings, $tag$dollar-quoted$tag$ strings, and numbers that do not continue an identifier or a placeholder ($1, ?2, :n stay as written). Double-quoted names stay where d reads them as identifiers. Control bytes print escaped.
Types ¶
type Dialect ¶
type Dialect int
Dialect is the engine whose quoting rules decide where a literal ends.
const ( // Unknown masks under every rule below at once: "double-quoted" text // is a string, # opens a comment, block comments nest, and a string // whose end depends on whether a backslash escapes masks the rest of // the statement. Unknown Dialect = iota // Postgres: "double-quoted" text is an identifier, a backslash // escapes only inside E'...', block comments nest, and // $tag$...$tag$ is a string. Postgres // SQLite reads "double-quoted" text as a string when no column has // that name, which the statement alone cannot rule out, so it is // masked. SQLite // MySQL (and MariaDB) read "double-quoted" text as a string, a // backslash as an escape in every string, and # as a line comment. MySQL )
Source Files