Suppose we have a simple update query:
UPDATE foo
SET
bar=$1
WHERE id=$2
where bar=$1
is generated based on user's input and it might be null, e.g.
UPDATE foo
SET
${assignmentList}
WHERE id=$2
How do I make this update operation into a no-op in case assignmentList
variable is empty?
I have tried using 1=1
, i.e.
UPDATE foo
SET
1=1
WHERE id=$2
but this gives a syntax error.
WHERE id=$2 AND (${assignmentList}) IS NOT NULL
. OrWHERE id=$2 AND LENGTH('${assignmentList}')>0
. Or something similar...${assignmentList}
on the application level, and do not execute the query at all when assignmentList it is empty.UPDATE foo SET id=id WHERE id=$2
or any other known column, but that would actually perform an update of the row.col = 1; DROP DATABASE this;--