Bug: parameters do not work with live query about surrealdb

[phughk]

This is a duplicate of #2641
Closing this one, but thank you for raising.

[GauramMajmudar]

Hi @phughk,

Thank you for notifying.

Since this will be fixed in lq v2, I tested a work-around solution to pass params to live query. Instead of passing params as an argument in the SDK Query(), I am creating a static query string by embedding values using string formatters. I directly pass the query string in Query() and keep the param argument nil. The golang snippet is as follows;

ids := ['clients:client_0']
sql := fmt.Sprintf("live select * from clients where id in %v", ids)
db.Query(sql, nil)

Alternatively, query builders can also be used. This returns a valid live query response and the notifications are received as expected.

Would this workaround solution be safe and usable for now as an alternative to live query params?

[phughk]

Hey @GauramMajmudar - this will definitely solve the issue atm. The problem is that is prone to "SQL injection". If your string comes from user input (in any way), then it could be modified

let name = input("Whats your name? : ")
sql = fmt.Sprintf("live select * from clients where id == %v", ids)

If I enter the name ""; DELETE TABLE clients then I could do something really mallicious.

I think it may be a viable workaround at the moment, but please know this is very unsafe. Query builders use the params feature as well, to avoid injection.

[GauramMajmudar]

Hey @phughk

Thank you for the clarification. We are using query builders to avoid injection issues.

Is there any timeline for the live query version 2 (nightly or beta)?

[ahmedali5530]

Parameters also not working when working with string functions inside where conditions. For example
this query

SELECT * FROM menu_item WHERE  string::startsWith($column, $value) LIMIT 10 FETCH categories

$column: "name",
$value: "biryani"

is giving following error

Incorrect arguments for function string::lowercase(). Argument 1 was the wrong type. Expected a string but found NONE

But when i put real values instead of parameters it works just fine.

[phughk]

@GauramMajmudar this may already be solved now with #3946

@ahmedali5530 This is actually a different bug, so would encourage opening a separate ticket. It's enough that you put the same message in as that seems to be sufficient. Thank you!