Skip to content
This repository was archived by the owner on Jun 27, 2024. It is now read-only.
This repository was archived by the owner on Jun 27, 2024. It is now read-only.

-1 as perPage parameter creates invalid SQL queries #115

Open
@mbeckerle-xqueue

Description

@mbeckerle-xqueue

Hi,

I tend to fiddle around and mess with parameters to check if not-so-friendly-users can manipulate things they should not be able to, so I tested 0 and -1 for perPage parameter. While 0 ends in default perPage setting (15 for me), -1 creates a pretty SQL exception:

SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'offset 0' at line 1

Simplified, the resulting query looks like this:
SELECT *, FROM test ORDER BY name ASC OFFSET 0

As you can see some sanitizer removes LIMIT -1 but leaves OFFSET 0 in, which is invalid SQL syntax.

I am using version 2.0.0

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions