question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Column name in QueryBuilder's orderBy is NOT escaped

See original GitHub issue

Issue type:

[ ] question [x] bug report [ ] feature request [ ] documentation issue

Database system/driver:

[ ] cordova [ ] mongodb [ ] mssql [x] mysql / mariadb [ ] oracle [ ] postgres [ ] cockroachdb [ ] sqlite [ ] sqljs [ ] react-native [ ] expo

TypeORM version:

[x] latest [ ] @next [ ] 0.x.x (or put your version here)

Steps to reproduce or a small repository showing the problem:

Pass a column name like key to QueryBuilder’s orderBy, the generated SQL will be ORDER BY key ASC which causes error.

Issue Analytics

  • State:open
  • Created 4 years ago
  • Reactions:3
  • Comments:7 (2 by maintainers)

github_iconTop GitHub Comments

1reaction
d3-dmitriy-onypkocommented, Jul 25, 2019

Same issue. Also @Menci { '`key`': xxx } does not help. You need { `"key"`: xxx }

1reaction
Mencicommented, Jun 6, 2019

I’m sorry. It’s not .find(), it’s QueryBuilder’s .orderBy(). Code is below:

const TypeORM = require("typeorm");

const TestTable = new TypeORM.EntitySchema({
    name: "test_table",
    columns: {
        key: {
            primary: true,
            type: "int",
            generated: true
        }
    }
});

TypeORM.createConnection({
    type: "mysql",
    host: "localhost",
    port: 3306,
    username: "syzoj",
    password: "3RckWNyUTrwdNx97",
    database: "syzoj",
    synchronize: true,
    logging: true,
    entities: [TestTable]
}).then(connection => {
    connection.getRepository('test_table').createQueryBuilder()
      .select('*')
      .orderBy({
        key: 'DESC'
      })
      .getMany();
});
Read more comments on GitHub >

github_iconTop Results From Across the Web

Order by multiple columns with Doctrine - Stack Overflow
I'm using a QueryBuilder to create the query. If I call the orderBy method a second time, it replaces any previously specified orderings....
Read more >
Select using Query Builder - typeorm - GitBook
It's a parameter we used to prevent SQL injection. We could have written: where("user.name = '" + name + "') , however this...
Read more >
Class yii\db\QueryBuilder
Note that the values in each row must match the corresponding column names. The method will properly escape the column names, and quote...
Read more >
ORMLite Documentation
Specify the SQL necessary to create this field in the database including the column name, which should be properly escaped and in proper...
Read more >
Query Builder Class — CodeIgniter 3.1.13 documentation
... CodeIgniter will not try to protect your field or table names. This is useful if you need a compound select statement where...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found