HoHD/PR-Helper
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: escape 'key' as reserved word in all MySQL queries with backticks

Browse Source
This commit is contained in:
wonder
2026-06-20 23:21:24 +08:00
parent 99fb89c60d
commit 735126ff56
7 changed files with 22 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
database/db.go
+12 -12
View File
@@ -41,10 +41,10 @@ func (db *DB) Conn() *sql.DB {
func (db *DB) migrate() error { func (db *DB) migrate() error {
stmts := []string{ stmts := []string{
`CREATE TABLE IF NOT EXISTS settings ( "CREATE TABLE IF NOT EXISTS settings (" +
key VARCHAR(255) PRIMARY KEY, "`key` VARCHAR(255) PRIMARY KEY," +
value TEXT NOT NULL "value TEXT NOT NULL" +
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4`, ") ENGINE=InnoDB DEFAULT CHARSET=utf8mb4",
`CREATE TABLE IF NOT EXISTS users ( `CREATE TABLE IF NOT EXISTS users (
id BIGINT AUTO_INCREMENT PRIMARY KEY, id BIGINT AUTO_INCREMENT PRIMARY KEY,
email VARCHAR(255) NOT NULL UNIQUE, email VARCHAR(255) NOT NULL UNIQUE,
@@ -52,13 +52,13 @@ func (db *DB) migrate() error {
created_at DATETIME DEFAULT CURRENT_TIMESTAMP, created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
updated_at DATETIME DEFAULT CURRENT_TIMESTAMP updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4`, ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4`,
`CREATE TABLE IF NOT EXISTS user_settings ( "CREATE TABLE IF NOT EXISTS user_settings (" +
user_id BIGINT NOT NULL, "user_id BIGINT NOT NULL," +
key VARCHAR(255) NOT NULL, "`key` VARCHAR(255) NOT NULL," +
value TEXT NOT NULL, "value TEXT NOT NULL," +
PRIMARY KEY (user_id, key), "PRIMARY KEY (user_id, `key`)," +
FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE "FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE" +
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4`, ") ENGINE=InnoDB DEFAULT CHARSET=utf8mb4",
`CREATE TABLE IF NOT EXISTS repositories ( `CREATE TABLE IF NOT EXISTS repositories (
id BIGINT AUTO_INCREMENT PRIMARY KEY, id BIGINT AUTO_INCREMENT PRIMARY KEY,
user_id BIGINT, user_id BIGINT,
@@ -105,7 +105,7 @@ func (db *DB) migrate() error {
func (db *DB) seedDefaults() error { func (db *DB) seedDefaults() error {
for key, val := range models.DefaultSettings { for key, val := range models.DefaultSettings {
_, err := db.conn.Exec( _, err := db.conn.Exec(
`INSERT IGNORE INTO settings (key, value) VALUES (?, ?)`, key, val, "INSERT IGNORE INTO settings (`key`, value) VALUES (?, ?)", key, val,
) )
if err != nil { if err != nil {
log.Printf("warning: failed to seed setting %s: %v", key, err) log.Printf("warning: failed to seed setting %s: %v", key, err)
handlers/auth.go
+1 -1
View File
@@ -126,7 +126,7 @@ func (h *AuthHandler) HandleRegister(c *gin.Context) {
// Seed default settings for the user // Seed default settings for the user
for key, val := range defaultUserSettings { for key, val := range defaultUserSettings {
h.db.Exec(`INSERT IGNORE INTO user_settings (user_id, key, value) VALUES (?, ?, ?)`, userID, key, val) h.db.Exec("INSERT IGNORE INTO user_settings (user_id, `key`, value) VALUES (?, ?, ?)", userID, key, val)
} }
// Auto-login: set session // Auto-login: set session
handlers/pages.go
+3 -3
View File
@@ -55,8 +55,8 @@ func (h *PageHandler) Review(c *gin.Context) {
topN := "20" topN := "20"
concurrency := "5" concurrency := "5"
if user != nil { if user != nil {
h.db.QueryRow(`SELECT value FROM user_settings WHERE user_id = ? AND key = 'review.top_n'`, user.ID).Scan(&topN) h.db.QueryRow("SELECT value FROM user_settings WHERE user_id = ? AND `key` = 'review.top_n'", user.ID).Scan(&topN)
h.db.QueryRow(`SELECT value FROM user_settings WHERE user_id = ? AND key = 'review.concurrency'`, user.ID).Scan(&concurrency) h.db.QueryRow("SELECT value FROM user_settings WHERE user_id = ? AND `key` = 'review.concurrency'", user.ID).Scan(&concurrency)
} }
if topN == "" { if topN == "" {
topN = "20" topN = "20"
@@ -78,7 +78,7 @@ func (h *PageHandler) Settings(c *gin.Context) {
settings[key] = "" settings[key] = ""
} }
if user != nil { if user != nil {
rows, err := h.db.Query(`SELECT key, value FROM user_settings WHERE user_id = ?`, user.ID) rows, err := h.db.Query("SELECT `key`, value FROM user_settings WHERE user_id = ?", user.ID)
if err == nil { if err == nil {
defer rows.Close() defer rows.Close()
for rows.Next() { for rows.Next() {
handlers/repos.go
+1 -1
View File
@@ -100,7 +100,7 @@ func (h *ReposHandler) CleanupRepos(c *gin.Context) {
} }
var maxAgeDays string var maxAgeDays string
h.db.QueryRow(`SELECT value FROM user_settings WHERE user_id = ? AND key = 'cache.max_age_days'`, user.ID).Scan(&maxAgeDays) h.db.QueryRow("SELECT value FROM user_settings WHERE user_id = ? AND `key` = 'cache.max_age_days'", user.ID).Scan(&maxAgeDays)
if maxAgeDays == "" { if maxAgeDays == "" {
maxAgeDays = "7" maxAgeDays = "7"
} }
handlers/review.go
+2 -2
View File
@@ -60,7 +60,7 @@ func (h *ReviewHandler) Review(c *gin.Context) {
topN = *req.TopN topN = *req.TopN
} else { } else {
var topNStr string var topNStr string
h.db.QueryRow(`SELECT value FROM user_settings WHERE user_id = ? AND key = 'review.top_n'`, user.ID).Scan(&topNStr) h.db.QueryRow("SELECT value FROM user_settings WHERE user_id = ? AND `key` = 'review.top_n'", user.ID).Scan(&topNStr)
if topNStr != "" { if topNStr != "" {
if n, err := strconv.Atoi(topNStr); err == nil && n > 0 { if n, err := strconv.Atoi(topNStr); err == nil && n > 0 {
topN = n topN = n
@@ -74,7 +74,7 @@ func (h *ReviewHandler) Review(c *gin.Context) {
concurrency = *req.Concurrency concurrency = *req.Concurrency
} else { } else {
var concStr string var concStr string
h.db.QueryRow(`SELECT value FROM user_settings WHERE user_id = ? AND key = 'review.concurrency'`, user.ID).Scan(&concStr) h.db.QueryRow("SELECT value FROM user_settings WHERE user_id = ? AND `key` = 'review.concurrency'", user.ID).Scan(&concStr)
if concStr != "" { if concStr != "" {
if n, err := strconv.Atoi(concStr); err == nil && n > 0 { if n, err := strconv.Atoi(concStr); err == nil && n > 0 {
concurrency = n concurrency = n
handlers/settings.go
+2 -2
View File
@@ -23,7 +23,7 @@ func (h *SettingsHandler) GetSettings(c *gin.Context) {
} }
settings := make(map[string]string) settings := make(map[string]string)
rows, err := h.db.Query(`SELECT key, value FROM user_settings WHERE user_id = ?`, user.ID) rows, err := h.db.Query("SELECT `key`, value FROM user_settings WHERE user_id = ?", user.ID)
if err != nil { if err != nil {
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
return return
@@ -56,7 +56,7 @@ func (h *SettingsHandler) UpdateSettings(c *gin.Context) {
return return
} }
for key, val := range body { for key, val := range body {
_, err := tx.Exec(`INSERT INTO user_settings (user_id, key, value) VALUES (?, ?, ?) ON DUPLICATE KEY UPDATE value = VALUES(value)`, user.ID, key, val) _, err := tx.Exec("INSERT INTO user_settings (user_id, `key`, value) VALUES (?, ?, ?) ON DUPLICATE KEY UPDATE value = VALUES(value)", user.ID, key, val)
if err != nil { if err != nil {
tx.Rollback() tx.Rollback()
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
services/llm.go
+1 -1
View File
@@ -21,7 +21,7 @@ type LLMConfig struct {
func GetLLMConfig(db *sql.DB, userID int64) (LLMConfig, error) { func GetLLMConfig(db *sql.DB, userID int64) (LLMConfig, error) {
config := LLMConfig{} config := LLMConfig{}
rows, err := db.Query(`SELECT key, value FROM user_settings WHERE user_id = ? AND key IN ('llm.endpoint', 'llm.api_key', 'llm.model')`, userID) rows, err := db.Query("SELECT `key`, value FROM user_settings WHERE user_id = ? AND `key` IN ('llm.endpoint', 'llm.api_key', 'llm.model')", userID)
if err != nil { if err != nil {
return config, fmt.Errorf("read settings: %w", err) return config, fmt.Errorf("read settings: %w", err)
} }