Column name in QueryBuilder's orderBy is NOT escaped
See original GitHub issueIssue type:
[ ] question [x] bug report [ ] feature request [ ] documentation issue
Database system/driver:
[ ] cordova
[ ] mongodb
[ ] mssql
[x] mysql
/ mariadb
[ ] oracle
[ ] postgres
[ ] cockroachdb
[ ] sqlite
[ ] sqljs
[ ] react-native
[ ] expo
TypeORM version:
[x] latest
[ ] @next
[ ] 0.x.x
(or put your version here)
Steps to reproduce or a small repository showing the problem:
Pass a column name like key
to QueryBuilder’s orderBy, the generated SQL will be ORDER BY key ASC
which causes error.
Issue Analytics
- State:
- Created 4 years ago
- Reactions:3
- Comments:7 (2 by maintainers)
Top Results From Across the Web
Order by multiple columns with Doctrine - Stack Overflow
I'm using a QueryBuilder to create the query. If I call the orderBy method a second time, it replaces any previously specified orderings....
Read more >Select using Query Builder - typeorm - GitBook
It's a parameter we used to prevent SQL injection. We could have written: where("user.name = '" + name + "') , however this...
Read more >Class yii\db\QueryBuilder
Note that the values in each row must match the corresponding column names. The method will properly escape the column names, and quote...
Read more >ORMLite Documentation
Specify the SQL necessary to create this field in the database including the column name, which should be properly escaped and in proper...
Read more >Query Builder Class — CodeIgniter 3.1.13 documentation
... CodeIgniter will not try to protect your field or table names. This is useful if you need a compound select statement where...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
Same issue. Also @Menci
{ '`key`': xxx }
does not help. You need{ `"key"`: xxx }
I’m sorry. It’s not
.find()
, it’s QueryBuilder’s.orderBy()
. Code is below: