开发者

SQLite SELECT not working in Ruby when used with regex capture string, but works with string literal

开发者 https://www.devze.com 2023-03-19 10:54 出处:网络
I am using the followin开发者_如何学Pythong regex to capture to match an IRC PART message: :(?<nick>[a-zA-Z\\d<\\-\\[\\]\\\\^{}_]+)!(.+)@(.+) PART (?<chan>[#&][^\\x07\\x2C\\s]{0,20

I am using the followin开发者_如何学Pythong regex to capture to match an IRC PART message:

:(?<nick>[a-zA-Z\d<\-\[\]\\^{}_]+)!(.+)@(.+) PART (?<chan>[#&][^\x07\x2C\s]{0,200}) :(.+)

It matches and captures the groups correctly, because when this code is run:

part_regex.match resp do |m|
    puts "#{m[:nick]} has parted."
    puts db.execute("SELECT * FROM users WHERE nick = ?", m[:nick])
end

The first puts works, and outputs the correct string. But the second puts doesn't output anything. I know that the nick capture exists in the table. Whenever I use a literal string instead of m[:nick], it works just fine. I am using the sqlite3-ruby Gem for manipulating the database.

Here is the full output whenever it receives a PART message:

>> :mark!~mark@Mark-Szymanskis-MacBook.local PART #testing :mark
mark has parted.


I decided on using string interpolation instead of placeholders.

 db.execute("SELECT * FROM users WHERE nick = '#{SQLite3::Database.quote m[:nick]}'")


Some database libraries, such as ActiveRecord allows SQL injection prevention using the "?" as a placeholder. I am not sure what database library you are using, but it may not support this type of string interpolation. Even if it does, it may still need to have the "?" surrounded by single quotes.

0

精彩评论

暂无评论...
验证码 换一张
取 消