Build escaped queries in the app itself
universally replace String with Text
This commit is contained in:
@@ -10,7 +10,7 @@ import Database.HDBC (IConnection, SqlValue, toSql, prepare,
|
||||
quickQuery, fromSql, execute, seState, fetchAllRowsAL)
|
||||
|
||||
import PgQuery (LoginAttempt(..), insert, addUser, signInRole, checkPass
|
||||
, pgFormatIdentifier, pgFormatLiteral)
|
||||
, pgFmtIdent, pgFmtLit)
|
||||
import Types (SqlRow(SqlRow))
|
||||
import TestTypes (fromList, incStr, incNullableStr, incInsert, incId)
|
||||
import Data.Map (toList)
|
||||
@@ -87,16 +87,16 @@ spec = around dbWithSchema $ do
|
||||
signInRole "not-a-user" pass conn `shouldReturn` LoginFailed
|
||||
signInRole user (pass <> "crap") conn `shouldReturn` LoginFailed
|
||||
|
||||
describe "pgFormatIdentifier" $
|
||||
describe "pgFmtIdent" $
|
||||
it "Does what format %I would do" $ \conn ->
|
||||
property $ monadicIO $ do
|
||||
fuzz <- pick arbitrary
|
||||
[[row]] <- run $ quickALQuery conn "select format('%I', ? :: varchar)" [toSql (fuzz :: String)]
|
||||
assert $ fromSql (snd row) == pgFormatIdentifier (cs fuzz)
|
||||
assert $ fromSql (snd row) == pgFmtIdent (cs fuzz)
|
||||
|
||||
describe "pgFormatLiteral" $
|
||||
describe "pgFmtLit" $
|
||||
it "Does what format %L would do" $ \conn ->
|
||||
property $ monadicIO $ do
|
||||
fuzz <- pick arbitrary
|
||||
[[row]] <- run $ quickALQuery conn "select format('%L', ? :: varchar)" [toSql (fuzz :: String)]
|
||||
assert $ fromSql (snd row) == pgFormatLiteral (cs fuzz)
|
||||
assert $ fromSql (snd row) == pgFmtLit (cs fuzz)
|
||||
|
||||
Reference in New Issue
Block a user