如何使用 Java 确保输入 SQL 语句具有有效的列名？

Question

I am writing Java program that reads in SQL Statement as string file, however the programs needs to validate that the SQL statement has valid column names. There are 2 files that hold the column names and they are stored in a string as well. I am struggling with figuring out the logic on how to compare both files to the one SQL statement string.

Here is an example of a possible SQL Statement the user can input: SELECT * JobHost where class_id ='MAA';

My first approach is to split the file by select & from then read it line by line and store it an array list. And then compare the array list to the string file column names or maybe place the column names in an array list.

What is the best way to go about this?

Answer 1

Impossible.

SQL is a complex language and the only way to do what you want is to write a full blown SQL parser which is a project that involves being quite familiar with very complicated libraries (parser libraries). An expert would need weeks to build that up.

Your question also makes assumptions you can't make. These are examples of valid SQL, and they don't select on columns, but columns are involved in some of these:

• SELECT 1;
• SELECT colname > 1 FROM foo;
• SELECT x."ALIAS" FROM (SELECT colname AS alias FROM table) x;
• SELECT EXTRACT(YEAR from colname) FROM table;

Just look at that third one, and realize that you stand no chance.

Then look at the 4th and realize that if you want to go down the path of validating that some string contains sane SQL prior to throwing that SQL at the database is vastly more complex than you seem to think it is: That colname can still be checked, but you shouldn't stop at checking if that is a valid column, you should also check if the column is of a type that is supported in an EXTRACT(YEAR from) operation.

Then realize that just about every SQL engine out there supports widely different SQL syntax and extensions, so you can't just write one SQL parser, you'd have to write one for psql, one for mysql, one for mssql, and so on.

Hopeless situation.

So, what to do?

Just run that stuff: Toss it at the DB. If it's invalid, the DB will tell you with an SQLException . you can fetch the specific db error from this with sqlEx.getSQLState() . Unfortunately, that string is entirely dependent on the underlying SQL engine, but fortunately, most SQL engines give highly specific machine parsable information. For example, if there's gobbledygook in there, psql would give you 42601 . If you want to tell the difference, write an SQL statement with a specific problem you'd like to know about (such as using a colname that doesn't exist), run it, print the SQLState. Now you know what to look for.