Skip to content

Escape generated SQL identifiers#17

Open
akshithg wants to merge 1 commit into
letsencrypt:mainfrom
trailofbits:escape-identifier-quotes
Open

Escape generated SQL identifiers#17
akshithg wants to merge 1 commit into
letsencrypt:mainfrom
trailofbits:escape-identifier-quotes

Conversation

@akshithg
Copy link
Copy Markdown

@akshithg akshithg commented Jun 5, 2026

Summary

Fixes #16.

This change escapes dialect-specific quote characters inside generated SQL
identifiers. SQLite and PostgreSQL identifiers now double embedded "
characters, and MySQL identifiers now double embedded backticks. Qualified table
names also quote schema components before concatenating them with table names.

The same quoting helpers are used for index DDL names. The regression coverage
checks DML generated from table metadata and DDL generated from index, schema,
and table metadata.

Verification

  • go test ./... -run '^(TestSqliteDialectEscapesIdentifierQuotes|TestQuotedTableNameCannotRewriteUpdateTarget|TestCreateIndexQuotesIdentifierMetadata|TestDropIndexQuotesIdentifierMetadata|TestMySQLDialect|TestPostgresDialect)$' -count=1 -v
  • go test ./... -count=1
  • go build ./...
  • git diff --cached --check

@akshithg akshithg requested a review from a team as a code owner June 5, 2026 22:33
@akshithg akshithg requested a review from jsha June 5, 2026 22:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Generated SQL identifiers should escape embedded quote characters

1 participant