Method SaveView

core/view.go:37–72

SaveView creates (or updates already existing) persistent SQL view. NB! Be aware that this method is vulnerable to SQL injection and its arguments must come only from trusted input!

(dangerousViewName string, dangerousSelectQuery string)

// NB! Be aware that this method is vulnerable to SQL injection and
// its arguments must come only from trusted input!
func (app *BaseApp) SaveView(dangerousViewName string, dangerousSelectQuery string) error {
	return app.RunInTransaction(func(txApp App) error {
		// delete old view (if exists)
		err := txApp.DeleteView(dangerousViewName)
		if err != nil {
			return err
		}

		dangerousSelectQuery, err = normalizeViewSelectQuery(dangerousSelectQuery)
		if err != nil {
			return err
		}

		// (re)create the view
		//
		// note: the query is wrapped in a secondary SELECT as a rudimentary
		// measure to discourage multiple inline sql statements execution
		viewQuery := fmt.Sprintf("CREATE VIEW {{%s}} AS SELECT * FROM (%s)", dangerousViewName, dangerousSelectQuery)
		_, err = txApp.DB().NewQuery(viewQuery).Execute()
		if err != nil {
			return err
		}

		// fetch the view table info to ensure that the view was created
		// because missing tables or columns won't return an error
		if _, err := txApp.TableInfo(dangerousViewName); err != nil {
			// manually cleanup previously created view in case the func
			// is called in a nested transaction and the error is discarded
			txApp.DeleteView(dangerousViewName)

			return err
		}

		return nil
	})
}

// CreateViewFields creates a new FieldsList from the provided select query.
//