Documentation
¶
Overview ¶
Package query provides filter parsing, query building, and SQL injection prevention for the Faucet API layer. It converts DreamFactory-compatible filter expressions into parameterized SQL WHERE clauses.
Index ¶
- func AtPPlaceholder(index int) string
- func BuildLimitOffset(limit, offset int) string
- func BuildOrderSQL(clauses []OrderClause, quoteFn func(string) string) string
- func DollarPlaceholder(index int) string
- func MySQLQuote(name string) string
- func ParseFieldSelection(fields string) ([]string, error)
- func PostgresQuote(name string) string
- func QuestionPlaceholder(_ int) string
- func QuoteIdentifiers(names []string, quoteFn func(string) string) (string, error)
- func SQLServerQuote(name string) string
- func SanitizeStringValue(val string, maxLen int) (string, error)
- func ValidateIdentifier(name string) error
- func ValidateIdentifiers(names []string) error
- type OrderClause
- type ParsedFilter
- type PlaceholderFunc
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AtPPlaceholder ¶
AtPPlaceholder returns @p1, @p2, etc. (SQL Server).
func BuildLimitOffset ¶
BuildLimitOffset returns a LIMIT/OFFSET SQL fragment suitable for PostgreSQL and MySQL. Returns empty string if limit is 0.
func BuildOrderSQL ¶
func BuildOrderSQL(clauses []OrderClause, quoteFn func(string) string) string
BuildOrderSQL builds an ORDER BY SQL fragment from order clauses, applying the given quote function to column names.
func DollarPlaceholder ¶
DollarPlaceholder returns $1, $2, etc. (PostgreSQL).
func MySQLQuote ¶
MySQLQuote returns a MySQL-style backtick-quoted identifier.
func ParseFieldSelection ¶
ParseFieldSelection parses a comma-separated field list like "id,name,email" into a slice of validated column names. Whitespace around names is trimmed. Returns nil for an empty input string.
func PostgresQuote ¶
PostgresQuote returns a PostgreSQL-style double-quoted identifier.
func QuestionPlaceholder ¶
QuestionPlaceholder returns ? for all params (MySQL, SQLite).
func QuoteIdentifiers ¶
QuoteIdentifiers validates, quotes, and joins column names into a comma-separated SQL fragment. For example, with PostgreSQL quoting: ["id", "name", "email"] -> `"id", "name", "email"`
func SQLServerQuote ¶
SQLServerQuote returns a SQL Server-style bracket-quoted identifier.
func SanitizeStringValue ¶
SanitizeStringValue removes null bytes and validates string length. This is a secondary defense; parameterization is the primary protection.
func ValidateIdentifier ¶
ValidateIdentifier ensures a SQL identifier (column name, table name) is safe. It rejects empty strings, strings over 128 characters, strings that don't match the identifier pattern, and SQL reserved words.
func ValidateIdentifiers ¶
ValidateIdentifiers validates multiple identifiers, returning the first error found.
Types ¶
type OrderClause ¶
type OrderClause struct {
Column string // Validated column name.
Direction string // "ASC" or "DESC".
}
OrderClause represents a single column ordering directive.
func ParseOrderClause ¶
func ParseOrderClause(order string) ([]OrderClause, error)
ParseOrderClause parses a DreamFactory-style order string like "created_at DESC, name ASC" into validated OrderClause slices. Each element is "column [ASC|DESC]"; direction defaults to ASC if omitted.
func (OrderClause) String ¶
func (o OrderClause) String() string
String returns the SQL fragment for this order clause, e.g. "created_at DESC".
type ParsedFilter ¶
type ParsedFilter struct {
SQL string // e.g. "(age > $1) AND (status = $2)"
Params []interface{} // e.g. [21, "active"]
}
ParsedFilter holds a parameterized SQL WHERE fragment and its bind values.
func ParseFilter ¶
func ParseFilter(filter string, ph PlaceholderFunc, startIndex int) (*ParsedFilter, error)
ParseFilter parses a DreamFactory-compatible filter string into a parameterized SQL WHERE clause fragment.
ph controls placeholder style ($1, ?, @p1). startIndex is the 1-based index for the first placeholder (useful when appending to an existing parameterized query).
Returns nil, nil for an empty filter string.
type PlaceholderFunc ¶
PlaceholderFunc returns the SQL placeholder for a given 1-based parameter index.
Source Files