You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<substringquery="SUBSTRING((%s) FROM %d FOR %d)"/>
1578
+
<concatenatequery="%s||%s"/>
1579
+
<casequery="SELECT (CASE WHEN (%s) THEN '1' ELSE '0' END)"/>
1580
+
<hex/>
1581
+
<inferencequery="SUBSTRING((%s) FROM %d FOR 1)>'%c'"/>
1582
+
<banner/>
1583
+
<current_userquery="CURRENT_USER"/>
1584
+
<current_dbquery="CURRENT_SCHEMA"/>
1585
+
<hostname/>
1586
+
<table_comment/>
1587
+
<column_comment/>
1588
+
<is_dbaquery="(SELECT UPPER(CURRENT_USER) FROM INFORMATION_SCHEMA.IO_STATISTICS)='_SYSTEM'"/>
1589
+
<check_udf/>
1590
+
<users>
1591
+
<inbandquery="SELECT user_name FROM INFORMATION_SCHEMA.USERS"/>
1592
+
<blindquery="SELECT TOP (%d,1) user_name FROM INFORMATION_SCHEMA.USERS"count="SELECT COUNT(user_name) FROM INFORMATION_SCHEMA.USERS"/>
1593
+
</users>
1594
+
<passwords>
1595
+
<inbandquery="SELECT user_name,password FROM INFORMATION_SCHEMA.USERS"condition="user_name"/>
1596
+
<blindquery="SELECT TOP (%d,1) password FROM INFORMATION_SCHEMA.USERS WHERE user_name='%s'"count="SELECT COUNT(password) FROM INFORMATION_SCHEMA.USERS WHERE user_name='%s'"/>
1597
+
</passwords>
1598
+
<privileges/>
1599
+
<roles/>
1600
+
<statements/>
1601
+
<dbs>
1602
+
<inbandquery="SELECT "schema_name" FROM INFORMATION_SCHEMA.SCHEMATA"/>
1603
+
<blindquery="SELECT TOP (%d,1) "schema_name" FROM INFORMATION_SCHEMA.SCHEMATA"count="SELECT COUNT("schema_name") FROM INFORMATION_SCHEMA.SCHEMATA"/>
1604
+
</dbs>
1605
+
<tables>
1606
+
<inbandquery="SELECT "schema_name","table_name" FROM INFORMATION_SCHEMA.TABLES AS a JOIN INFORMATION_SCHEMA.SCHEMATA AS b ON a.schema_pk=b.schema_pk"condition=""schema_name""/>
1607
+
<blindquery="SELECT TOP (%d,1) "table_name" FROM INFORMATION_SCHEMA.TABLES AS a JOIN INFORMATION_SCHEMA.SCHEMATA AS b ON a.schema_pk=b.schema_pk WHERE "schema_name"='%s'"count="SELECT COUNT("table_name") FROM INFORMATION_SCHEMA.TABLES AS a JOIN INFORMATION_SCHEMA.SCHEMATA AS b ON a.schema_pk=b.schema_pk WHERE "schema_name"='%s'"/>
1608
+
</tables>
1609
+
<columns>
1610
+
<inbandquery="SELECT "column_name",data_type FROM INFORMATION_SCHEMA.COLUMNS,INFORMATION_SCHEMA.DATA_TYPE_DESCRIPTOR,INFORMATION_SCHEMA.TABLES,INFORMATION_SCHEMA.SCHEMATA WHERE INFORMATION_SCHEMA.COLUMNS.table_pk=INFORMATION_SCHEMA.TABLES.table_pk AND INFORMATION_SCHEMA.DATA_TYPE_DESCRIPTOR.column_name_pk=INFORMATION_SCHEMA.COLUMNS.column_pk AND INFORMATION_SCHEMA.TABLES.schema_pk=INFORMATION_SCHEMA.SCHEMATA.schema_pk AND "table_name"='%s' AND "schema_name"='%s'"condition=""column_name""/>
1611
+
<blind query="SELECT "column_name" FROM INFORMATION_SCHEMA.COLUMNS,INFORMATION_SCHEMA.TABLES,INFORMATION_SCHEMA.SCHEMATA WHERE INFORMATION_SCHEMA.COLUMNS.table_pk=INFORMATION_SCHEMA.TABLES.table_pk AND INFORMATION_SCHEMA.TABLES.schema_pk=INFORMATION_SCHEMA.SCHEMATA.schema_pk AND "table_name"='%s' AND "schema_name"='%s'" query2="SELECT data_type FROM INFORMATION_SCHEMA.COLUMNS,INFORMATION_SCHEMA.DATA_TYPE_DESCRIPTOR,INFORMATION_SCHEMA.TABLES,INFORMATION_SCHEMA.SCHEMATA WHERE INFORMATION_SCHEMA.COLUMNS.table_pk=INFORMATION_SCHEMA.TABLES.table_pk AND INFORMATION_SCHEMA.DATA_TYPE_DESCRIPTOR.column_name_pk=INFORMATION_SCHEMA.COLUMNS.column_pk AND INFORMATION_SCHEMA.TABLES.schema_pk=INFORMATION_SCHEMA.SCHEMATA.schema_pk AND "table_name"='%s' AND "column_name"='%s' AND "schema_name"='%s'" count="SELECT COUNT("column_name") FROM INFORMATION_SCHEMA.COLUMNS,INFORMATION_SCHEMA.TABLES,INFORMATION_SCHEMA.SCHEMATA WHERE INFORMATION_SCHEMA.COLUMNS.table_pk=INFORMATION_SCHEMA.TABLES.table_pk AND INFORMATION_SCHEMA.TABLES.schema_pk=INFORMATION_SCHEMA.SCHEMATA.schema_pk AND "table_name"='%s' AND "schema_name"='%s'" condition=""column_name""/>
1612
+
</columns>
1613
+
<dump_table>
1614
+
<inbandquery="SELECT %s FROM %s.%s"/>
1615
+
<blindquery="SELECT TOP (%d,1) %s FROM %s.%s"count="SELECT COUNT(*) FROM %s.%s"/>
1616
+
</dump_table>
1617
+
<search_db>
1618
+
<inbandquery="SELECT "schema_name" FROM INFORMATION_SCHEMA.SCHEMATA WHERE %s"condition=""schema_name""/>
1619
+
<blindquery="SELECT "schema_name" FROM INFORMATION_SCHEMA.SCHEMATA WHERE %s"count="SELECT COUNT("schema_name") FROM INFORMATION_SCHEMA.SCHEMATA WHERE %s"condition=""schema_name""/>
1620
+
</search_db>
1621
+
<search_table>
1622
+
<inbandquery="SELECT "schema_name","table_name" FROM INFORMATION_SCHEMA.TABLES AS a JOIN INFORMATION_SCHEMA.SCHEMATA AS b ON a.schema_pk=b.schema_pk WHERE %s"condition=""table_name""condition2=""schema_name""/>
1623
+
<blindquery="SELECT "schema_name" FROM INFORMATION_SCHEMA.TABLES AS a JOIN INFORMATION_SCHEMA.SCHEMATA AS b ON a.schema_pk=b.schema_pk WHERE %s"query2="SELECT "table_name" FROM INFORMATION_SCHEMA.TABLES AS a JOIN INFORMATION_SCHEMA.SCHEMATA AS b ON a.schema_pk=b.schema_pk WHERE "schema_name"='%s'"count="SELECT COUNT("schema_name") FROM INFORMATION_SCHEMA.TABLES AS a JOIN INFORMATION_SCHEMA.SCHEMATA AS b ON a.schema_pk=b.schema_pk WHERE %s"count2="SELECT COUNT("table_name") FROM INFORMATION_SCHEMA.TABLES AS a JOIN INFORMATION_SCHEMA.SCHEMATA AS b ON a.schema_pk=b.schema_pk WHERE "schema_name"='%s'"condition=""table_name""condition2=""schema_name""/>
1624
+
</search_table>
1625
+
<!-- NOTE: Not working properly with DISTINCT(...) in subquery -->
1626
+
<search_column>
1627
+
<inbandquery="SELECT "schema_name","table_name" FROM INFORMATION_SCHEMA.COLUMNS,INFORMATION_SCHEMA.TABLES,INFORMATION_SCHEMA.SCHEMATA WHERE INFORMATION_SCHEMA.COLUMNS.table_pk=INFORMATION_SCHEMA.TABLES.table_pk AND INFORMATION_SCHEMA.TABLES.schema_pk=INFORMATION_SCHEMA.SCHEMATA.schema_pk AND %s"condition=""column_name""condition2=""schema_name""condition3=""table_name""/>
1628
+
<blind query="SELECT "schema_name" FROM INFORMATION_SCHEMA.COLUMNS,INFORMATION_SCHEMA.TABLES,INFORMATION_SCHEMA.SCHEMATA WHERE INFORMATION_SCHEMA.COLUMNS.table_pk=INFORMATION_SCHEMA.TABLES.table_pk AND INFORMATION_SCHEMA.TABLES.schema_pk=INFORMATION_SCHEMA.SCHEMATA.schema_pk AND %s" query2="SELECT "table_name" FROM INFORMATION_SCHEMA.COLUMNS,INFORMATION_SCHEMA.TABLES,INFORMATION_SCHEMA.SCHEMATA WHERE INFORMATION_SCHEMA.COLUMNS.table_pk=INFORMATION_SCHEMA.TABLES.table_pk AND INFORMATION_SCHEMA.TABLES.schema_pk=INFORMATION_SCHEMA.SCHEMATA.schema_pk AND "schema_name"='%s'" count="SELECT COUNT("schema_name") FROM INFORMATION_SCHEMA.COLUMNS,INFORMATION_SCHEMA.TABLES,INFORMATION_SCHEMA.SCHEMATA WHERE INFORMATION_SCHEMA.COLUMNS.table_pk=INFORMATION_SCHEMA.TABLES.table_pk AND INFORMATION_SCHEMA.TABLES.schema_pk=INFORMATION_SCHEMA.SCHEMATA.schema_pk AND %s" count2="SELECT COUNT("table_name") FROM INFORMATION_SCHEMA.COLUMNS,INFORMATION_SCHEMA.TABLES,INFORMATION_SCHEMA.SCHEMATA WHERE INFORMATION_SCHEMA.COLUMNS.table_pk=INFORMATION_SCHEMA.TABLES.table_pk AND INFORMATION_SCHEMA.TABLES.schema_pk=INFORMATION_SCHEMA.SCHEMATA.schema_pk AND "schema_name"='%s'" condition=""column_name"" condition2=""schema_name"" condition3=""table_name""/>
ifretVal.upper() inkb.keywordsor (retValor" ")[0].isdigit() ornotre.match(r"\A[A-Za-z0-9_@%s\$]+\Z"% ('.'if_else""), retVal): # MsSQL is the only DBMS where we automatically prepend schema to table name (dot is normal)
4093
+
# Note: SQL 92 has restrictions for identifiers starting with underscore (e.g. http://www.frontbase.com/documentation/FBUsers_4.pdf)
4094
+
ifretVal.upper() inkb.keywordsor (notisTableand (retValor" ")[0] =='_') or (retValor" ")[0].isdigit() ornotre.match(r"\A[A-Za-z0-9_@%s\$]+\Z"% ('.'if_else""), retVal): # MsSQL is the only DBMS where we automatically prepend schema to table name (dot is normal)
4090
4095
retVal=unsafeSQLIdentificatorNaming(retVal)
4091
4096
4092
4097
ifBackend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ACCESS, DBMS.CUBRID, DBMS.SQLITE): # Note: in SQLite double-quotes are treated as string if column/identifier is non-existent (e.g. SELECT "foobar" FROM users)
0 commit comments