From 5a33e75c0f29eda648145e1521314ea6ef556d29 Mon Sep 17 00:00:00 2001
From: zhoudongbin <458405826@qq.com>
Date: Mon, 1 Apr 2024 18:34:37 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=94=B9=E5=8F=82=E6=95=B0=E5=8C=96?=
 =?UTF-8?q?=E6=9F=A5=E8=AF=A2=E7=9A=84=E5=8F=82=E6=95=B0=E4=B8=AD=EF=BC=8C?=
 =?UTF-8?q?=E6=B2=A1=E6=9C=89=E5=AF=B9[]byte=E5=92=8Cstring=E7=B1=BB?=
 =?UTF-8?q?=E5=9E=8B=E7=9A=84=E5=8F=82=E6=95=B0=E6=B7=BB=E5=8A=A0=E5=BC=95?=
 =?UTF-8?q?=E5=8F=B7=E7=9A=84=E9=97=AE=E9=A2=98=EF=BC=8C=E5=B9=B6=E5=AF=B9?=
 =?UTF-8?q?=E8=BD=AC=E4=B9=89=E5=AD=97=E7=AC=A6=E8=BF=9B=E8=A1=8C=E7=AE=80?=
 =?UTF-8?q?=E6=98=93=E5=A4=84=E7=90=86=E3=80=82?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 common/sql.go | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/common/sql.go b/common/sql.go
index d24b639e..979d9db3 100644
--- a/common/sql.go
+++ b/common/sql.go
@@ -1,6 +1,7 @@
 package common
 
 import (
+	"bytes"
 	"database/sql/driver"
 	"errors"
 	"fmt"
@@ -70,9 +71,19 @@ func InterpolateParams(query string, args []driver.NamedValue) (string, error) {
 			buf.WriteString(t)
 			buf.WriteByte('\'')
 		case []byte:
+			if bytesHasBackslash(v) {
+				return "", driver.ErrSkip
+			}
+			buf.WriteByte('\'')
 			buf.Write(v)
+			buf.WriteByte('\'')
 		case string:
+			if stringHasBackslash(v) {
+				return "", driver.ErrSkip
+			}
+			buf.WriteByte('\'')
 			buf.WriteString(v)
+			buf.WriteByte('\'')
 		default:
 			return "", driver.ErrSkip
 		}
@@ -96,3 +107,23 @@ func ValueArgsToNamedValueArgs(args []driver.Value) (values []driver.NamedValue)
 	}
 	return
 }
+
+func bytesHasBackslash(v []byte) bool {
+	escapeRunes := []rune{'\'', '"', '\\', '\x00', '\n', '\r', '\x1a'}
+	for _, r := range escapeRunes {
+		if bytes.ContainsRune(v, r) {
+			return true
+		}
+	}
+	return false
+}
+
+func stringHasBackslash(v string) bool {
+	escapeRunes := []rune{'\'', '"', '\\', '\x00', '\n', '\r', '\x1a'}
+	for _, r := range escapeRunes {
+		if strings.ContainsRune(v, r) {
+			return true
+		}
+	}
+	return false
+}