(query string, args []driver.Value)
| 350 | } |
| 351 | |
| 352 | func queryArgsConvert(query string, args []driver.Value) (string, error) { |
| 353 | if len(args) == 0 { |
| 354 | return query, nil |
| 355 | } |
| 356 | // a tiny, tiny, tiny bit of string sanitization |
| 357 | if strings.ContainsAny(query, `'"`) { |
| 358 | return "", nil |
| 359 | } |
| 360 | q := make([]string, 2*len(args)+1) |
| 361 | n := 0 |
| 362 | for _, a := range args { |
| 363 | i := strings.IndexRune(query, '?') |
| 364 | if i == -1 { |
| 365 | return "", errors.New("number of parameters doesn't match number of placeholders") |
| 366 | } |
| 367 | var s string |
| 368 | switch v := a.(type) { |
| 369 | case nil: |
| 370 | s = "NULL" |
| 371 | case string: |
| 372 | s = "'" + escapeString(v) + "'" |
| 373 | case []byte: |
| 374 | s = "'" + escapeString(string(v)) + "'" |
| 375 | case int64: |
| 376 | s = strconv.FormatInt(v, 10) |
| 377 | case time.Time: |
| 378 | s = "'" + v.Format(MysqlTimeFormat) + "'" |
| 379 | case bool: |
| 380 | if v { |
| 381 | s = "1" |
| 382 | } else { |
| 383 | s = "0" |
| 384 | } |
| 385 | case float64: |
| 386 | s = strconv.FormatFloat(v, 'e', 12, 64) |
| 387 | default: |
| 388 | panic(fmt.Sprintf("%v (%T) can't be handled by godrv", v, v)) |
| 389 | } |
| 390 | q[n] = query[:i] |
| 391 | q[n+1] = s |
| 392 | query = query[i+1:] |
| 393 | n += 2 |
| 394 | } |
| 395 | q[n] = query |
| 396 | return join(q), nil |
| 397 | } |
| 398 | |
| 399 | func escapeString(txt string) string { |
| 400 | var ( |
no test coverage detected