[
https://issues.apache.org/jira/browse/GROOVY-8804?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18074595#comment-18074595
]
Paul King edited comment on GROOVY-8804 at 4/18/26 9:49 PM:
------------------------------------------------------------
Yes, as reported, this is working as expected. You can also add ".toString()".
Both of these would be fine if your "values" variable is indeed a simple list
of known values that you generated. You can also keep it as a GString using
Sql.expand() on the parameter.
But all three would be subject to SQL injection if "values" came from say a web
page form or some other untrusted source.
The actually-safe pattern for a dynamic IN list is:
{code:groovy}
def values = ['1', '2']
def placeholders = (['?'] * values.size()).join(',')
sql.rows("SELECT id, name FROM employee WHERE id IN
($placeholders)".toString(), values)
{code}
There is also an existing ticket for native "IN" support GROOVY-5436.
was (Author: paulk):
Yes, as reported, this is working as expected. You can also add ".toString()".
The actually-safe pattern for a dynamic IN list is:
{code:groovy}
def values = ['1', '2']
def placeholders = (['?'] * values.size()).join(',')
sql.rows("SELECT id, name FROM employee WHERE id IN
($placeholders)".toString(), values)
{code}
There is also an existing ticket for native "IN" support GROOVY-5436.
> Sql.rows(gstring) fails while Sql.rows(string) works
> ----------------------------------------------------
>
> Key: GROOVY-8804
> URL: https://issues.apache.org/jira/browse/GROOVY-8804
> Project: Groovy
> Issue Type: Bug
> Components: SQL processing
> Affects Versions: 2.4.15, 2.6.0-alpha-4, 3.0.0-alpha-3, 2.5.2
> Reporter: John N Underwood
> Assignee: Paul King
> Priority: Minor
>
> Calling `sql.rows(string)` works while calling `sql.rows(gstring)` returns an
> empty result set.
> This indicates a possible bug in the protected method
> `groovy.sql.Sql.asSql()`.
> I have created a sample program which demonstrates the behavior at
> https://github.com/jnunderwood/groovy-sql-test
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
