squirrel
squirrel copied to clipboard
Limit and Offset use prepare statement placeholder
Can Limit()
and Offset()
functions make a placeholder for prepare statement?
Use squirrel v1.5.4 the result:
sql, args, err := squirrel.Select("id").From("mytable").Where("id < ?", 100).Limit(10).Offset(20).ToSql()
// output
sql: SELECT id FROM mytable WHERE id < ? LIMIT 10 OFFSET 20
args: [100]
// Expect output
sql: SELECT id FROM mytable WHERE id < ? LIMIT ? OFFSET ?
args: [100, 10, 20]
I likewise found this to be unexpected behavior. As those frequently come from query parameters (user input) when implementing pagination, this has security implementations.
In the meantime, a workaround is: Suffix("LIMIT ? OFFSET ?", limit, offset)
Hello! The problem is still present in the latest version of the project.
Could you please let me know if there are any planned actions or timelines for resolving this issue?