简体   繁体   English

AQL:在运算符上绑定参数

[英]AQL: Bind parameter on operator

Is there a way to have bind parameter on operator ("<", "<=" etc...)?有没有办法在运算符(“<”,“<=”等......)上有绑定参数? I'm working on a Foxx service.我正在开发 Foxx 服务。

Example:例子:

const operator = '<'
const res = query`
  FOR v IN myCollection
  FILTER v.value ${operator} ${maxValue}
`

I can do it with db._query :我可以用db._query做到这一点:

const operator = '<'
const res = db._query('
  FOR v IN myCollection
  FILTER v.value ${operator} @maxValue'
{ maxValue: 100 })

Normal bind parameters (with one @ ) can only be used for the values null , true , false , numbers, strings, arrays and objects.普通绑定参数(带有一个@ )只能用于值nulltruefalse 、数字、字符串、 arrays 和对象。 Collection bind parameters (with two @@ ) can be used where collection names are specified.集合绑定参数(带有两个@@ )可以在指定集合名称的地方使用。

Passing an operator via bind parameters is not possible in AQL, as it could likely change the meaning of a query, or render it totally invalid.在 AQL 中无法通过绑定参数传递运算符,因为它可能会改变查询的含义,或使其完全无效。

Consider the following example:考虑以下示例:

FOR v IN myCollection
FILTER v.value @operator @maxValue

This query does not even parse, regardless of what values are passed in the bind parameters.这个查询甚至不解析,不管绑定参数中传递了什么值。 And this is a good thing, because otherwise one may pass something like @operator: "abc" , @maxValue: ">=" , which would mean the query can be parsed fine without bind parameters, but would produce a parse error with bind parameters injected.这是一件好事,因为否则可能会传递类似@operator: "abc" , @maxValue: ">="类的东西,这意味着可以在没有绑定参数的情况下很好地解析查询,但使用绑定会产生解析错误注入的参数。

So the easiest solution here is to inject the comparison operator into the query via template string substituion, though of course you need to make sure the requested comparison operator is in a whitelisted of allowed operators.所以这里最简单的解决方案是通过模板字符串替换将比较运算符注入到查询中,当然您需要确保请求的比较运算符在允许的运算符的白名单中。 But you would need to do this even with bind parameters, as otherwise people could just send @operator: "!=" or @operator: "NOT IN" or other operators which you either don't expect or that can make your query more expensive.但是即使使用绑定参数,您也需要执行此操作,否则人们可以发送@operator: "!="@operator: "NOT IN"或其他您不期望或可以使您的查询更多的运算符昂贵的。

声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM