SQL identifiers and string literals aren't escaped in migration.go about homer-app HOT 3 CLOSED

Thanks for the report @grahamhoyes
Feel free to submit a PR with any desired changes to achieve compatibility with your target.

from homer-app.

Your report is appreciated. Please star this repository to motivate its developers! ⭐

from homer-app.

Some details on a possible fix, I am not familiar with go or gorm so there may be inaccuracies:

• I've only seen parameter binding with ?, %s, :name, etc work for values, not identifiers. That seems to be backed up by this stackoverflow post. So binding with ? could (and probably should) be used for the password when creating the user, but not elsewhere
• The issue https://github.com/golang/go/issues/18478 (intentionally not linked to avoid a spammy backlink) has been open for many years on providing escaping in database/sql, which I believe gorm is built on. Seems unlikely that will go anywhere.
• The postgres docs on syntax are here. The important part, which is what the above examples from pg8000 do:

  Quoted identifiers can contain any character, except the character with code zero. (To include a double quote, write two double quotes.)

• github.com/lib/pq has a QuoteIdentifier function here. That's probably exactly what we want. It doesn't cover the \0-containing edge case, but should be good enough.

from homer-app.