Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Procedure name is not escaped when using CommandType.StoredProcedure #1029

Copy link
Copy link
Closed
@kpreisser

Description

@kpreisser
Issue body actions

Hi,
I noticed that when using MySqlConnector to call a stored procedure by specifying DbCommand.CommandType = CommandType.StoredProcedure, the procedure name set in DbCommand.CommandText is not automatically escaped. However, MySQL Connector/NET seems to do this. For example:

  • In MySQL Workbench, create a procedure with a name that contains spaces like test spaces1:
delimiter //
CREATE PROCEDURE `test spaces1` (IN myVar INT)
    BEGIN
        SELECT 2 * myVar;
    END//
delimiter ;
  • Create the following .NET 5 program using Connector/NET (MySql.Data 8.0.26):
static void Main(string[] args)
{
    var conBuilder = new MySqlConnectionStringBuilder() {
        Server = "localhost",
        Port = 3306,
        UserID = "root",
        Password = "xxx",
        SslMode = MySqlSslMode.None,
        AllowPublicKeyRetrieval = true,
        Pooling = false,
        Database = "mydb"
    };

    using var con = new MySqlConnection(conBuilder.ToString());
    con.Open();

    using var cmd = con.CreateCommand();
    cmd.CommandType = System.Data.CommandType.StoredProcedure;
    cmd.CommandText = "test spaces1";

    cmd.Parameters.AddWithValue("myVar", 123);
    object result = cmd.ExecuteScalar();    
}
  • When running the program, it works as expected. Looking at the network connection, we can see that the following SQL is sent to the server:
CALL `mydb`.`test spaces1`(123)
  • Now switch to MySqlConnector 1.4.0-beta.2. Executing the program throw the following exception:
MySqlConnector.MySqlException (0x80004005): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'spaces1(123)' at line 1
  • We can see the following SQL is sent to the server (notice the procedure name is not escaped):
CALL test spaces1(123);

Is this intended behavior?
Thank you!

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

      Morty Proxy This is a proxified and sanitized view of the page, visit original site.