Live data from Hacker News

Show HN: Parse your Postgres queries into a fully-typed AST in TypeScript

21–22 of 22 posts

Re: Show HN: Parse your Postgres queries into a fully-typed AST in TypeScript

#21

Post by pesoneto » Mon, Sep 23, 2024, 2:37 AM UTC

Books have been written about SQL Injection. But in the end, SQL Injection just means that you get a different AST than what was intended.

So the simplest, stupid check for injection is to parse the query and see if multiple STMT's are found where only one was intended.

Better checks can easily be imagined.

Re: Show HN: Parse your Postgres queries into a fully-typed AST in TypeScript

#22

Post by pella » Mon, Sep 23, 2024, 6:07 PM UTC

libpg_query is a good library!

"C library for accessing the PostgreSQL parser outside of the server environment"

https://github.com/pganalyze/libpg_query?tab=readme-ov-file#...

  pg_query wrappers in other languages:
  - Ruby: pg_query
  - Go: pg_query_go
  - Javascript (Node): pgsql-parser
  - Javascript (Browser): pg-query-emscripten
  - Python: psqlparse, pglast, psqlparse2
  - OCaml: pg_query-ocaml
  - Rust: pg_query.rs

Post reply on HN