Multistatements and multi results #411
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- packets.go: flag clientMultiResults, update status when receiving an EOF packet, discard additional results on readRow when EOF is reached - statement.go: currently a nil rows.mc is used as an eof, don’t set it if there are no columns to avoid that Next() waits indefinitely - rows.go: discard additional results on close and avoid panic on Columns()
discard additional OK response after Multi Statement Exec Calls
0468e78
to
023343e
Compare
| Default: false | ||
| ``` | ||
|
|
||
| Allow multiple statements in one query. While this allows batch queries, it also greatly increases the risk of SQL injections. |
There was a problem hiding this comment.
add something like "results are returned for the first query only, others are silently discarded".
|
PTAL |
|
I'd like some tests and/or documentation for what happens if you run
And I'd prefer |
julienschmidt
added a commit
that referenced
this pull request
Jan 30, 2016
Multistatements and multi results
|
@julienschmidt thanks so much. Love you superman! |
5 tasks
arp242
added a commit
to arp242/mysql
that referenced
this pull request
May 16, 2023
I can't really find any reference to the risk of SQL injections. This sets the clientMultiStatements flag (or CLIENT_MULTI_STATEMENTS in the C API). This comment was added in go-sql-driver#411, but without much explanation, and I can't find anything in e.g. go-sql-driver#66 or other issues either. The documentation for MySQL[1] or MariaDB[2] doesn't warn for SQL injections, and after some internet searching the only reference I found was in the PHP Docs[3]: The API functions mysqli::query() and mysqli::real_query() do not set a connection flag necessary for activating multi queries in the server. An extra API call is used for multiple statements to reduce the damage of accidental SQL injection attacks. An attacker may try to add statements such as ; DROP DATABASE mysql or ; SELECT SLEEP(999). So I assume this is what this comment refers to. This removes the comment, as discussed in go-sql-driver#1206. [1]: https://dev.mysql.com/doc/c-api/8.0/en/c-api-multiple-queries.html [2]: https://mariadb.com/kb/en/mysql_real_connect/ [3]: https://www.php.net/manual/de/mysqli.quickstart.multiple-statement.php
5 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The daily PR:
multiStatements=true)Fixes #66
Fixes #163
Fixes #325
Fixes #338
Fixes #339