| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: perl-SQL-Abstract | Distribution: openSUSE Tumbleweed |
| Version: 2.000002 | Vendor: openSUSE |
| Release: 1.1 | Build date: Fri Nov 6 15:39:31 2026 |
| Group: Unspecified | Build host: reproducible |
| Size: 402352 | Source RPM: perl-SQL-Abstract-2.000002-1.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: https://metacpan.org/release/SQL-Abstract | |
| Summary: Generate SQL from Perl data structures | |
This module was inspired by the excellent DBIx::Abstract. However, in using
that module I found that what I really wanted to do was generate SQL, but
still retain complete control over my statement handles and use the DBI
interface. So, I set out to create an abstract SQL generation module.
While based on the concepts used by DBIx::Abstract, there are several
important differences, especially when it comes to WHERE clauses. I have
modified the concepts used to make the SQL easier to generate from Perl
data structures and, IMO, more intuitive. The underlying idea is for this
module to do what you mean, based on the data structures you provide it.
The big advantage is that you don't have to modify your code every time
your data changes, as this module figures it out.
To begin with, an SQL INSERT is as easy as just specifying a hash of
'key=value' pairs:
my %data = (
name => 'Jimbo Bobson',
phone => '123-456-7890',
address => '42 Sister Lane',
city => 'St. Louis',
state => 'Louisiana',
);
The SQL can then be generated with this:
my($stmt, @bind) = $sql->insert('people', \%data);
Which would give you something like this:
$stmt = "INSERT INTO people
(address, city, name, phone, state)
VALUES (?, ?, ?, ?, ?)";
@bind = ('42 Sister Lane', 'St. Louis', 'Jimbo Bobson',
'123-456-7890', 'Louisiana');
These are then used directly in your DBI code:
my $sth = $dbh->prepare($stmt);
$sth->execute(@bind);
Artistic-1.0 OR GPL-1.0-or-later
* Fri Nov 06 2026 Tina Müller <timueller+perl@suse.de>
- updated to 2.000002
see /usr/share/doc/packages/perl-SQL-Abstract/Changes
2.000002 - 2026-11-05
- SECURITY, CVE-2026-121265: array_datatypes is on by default, so an
arrayref as a column value in insert() or update() (and values())
is one bind value. Before, it was literal SQL and its first element
went into the SQL text: a JSON array or a repeated form field like
{ name => [ "x, is_admin = 1" ] } gave
UPDATE t SET name = x, is_admin = 1. Literal SQL is
\[ $sql, @bind ]; array_datatypes => 0 restores the old behaviour.
Incompatible for code that used a plain arrayref as literal SQL.
- SECURITY, CVE-2026-121007: the where / having / set values of a
nested statement ({ -select => ... }, { -update => ... } ...) in a
select list, ORDER BY, GROUP BY, RETURNING, FROM (-as) or JOIN (to)
became identifiers and went into the SQL text instead of @bind -
without quote_char unescaped, so { id => "1 OR 1=1" } ended up as
WHERE id = 1 OR 1=1. They are bind values again. The same goes for
the rows of a { -values => ... } in FROM.
bsc#1289543
- SECURITY, CVE-2026-121008: the html profile of SQL::Abstract::Tree
HTML-escapes the SQL text and the filled in bind values (new
html_escape option); before, a bind value like <script> went into
the page as-is
- SECURITY, CVE-2026-121009: injection_guard also checks the name of
an explicit { -func => [ $name, ... ] }, as documented; it only
checked the { -name => ... } shorthand before
bsc#1289544
- quote_char without name_sep: a dotted name like a.b renders as
"a"."b" (name_sep defaults to "."); before it came out as "a""b",
which is the single identifier a"b. An empty name_sep keeps a.b
as the single identifier "a.b".
- SQL::Abstract::Parts->format keeps every part of the statement when
it folds it across lines: a folded AND / OR list starts each
continuation line with its operator, a folded comma list keeps the
comma before its last item, a folded group keeps its closing
bracket, and a part longer than max_width gets a line of its own;
the folded text ends without a newline, like a statement that fits
on one line
- t/01generate.t: the infinite recursion watchdog gives each case 30
seconds instead of 1 and always switches its alarm off again; on
slow smokers a leftover alarm killed the whole test with
"Terminating on signal SIGALRM(14)" (seen on Win32)
- Docs: SQL::Abstract::Plugin::BangOverrides has an abstract and a
SYNOPSIS section
- SQL::Abstract::Tree: the indentmap understands "and", "or" and ","
to put AND / OR conditions and the items of a clause list (select
list, ORDER BY, GROUP BY, SET ...) on lines of their own; off in all
profiles unless asked for (idea from Ryan P. Kelly's format-sql branch)
- ORDER BY: { -asc => $col, -nulls => "first" } (or -desc, or "last")
renders $col ASC NULLS FIRST; the -nulls key applies to every column
of its -asc / -desc hash (idea and tests from ilmari)
- SQL::Abstract::Tree: an operator followed by a parenthesised
expression in a list (trunc(a - (b + c), 2)) no longer gets a comma
inserted in front of it, and a backslash-escaped question mark
operator for DBD::Pg (\?, \?|, \?&, \?-| ...) is kept as one operator
instead of being split up as a placeholder (tests by ilmari)
- New README.md (for the repository) and LICENSE file; the LICENSE is
now part of the repository and shipped as-is in the tarball
- New SECURITY.md: how to report security issues privately, which
versions get fixes and what counts as a security issue (RT#167662)
- Docs: new "SQL::Abstract, DBIx::Class and DBIO" section - DBIx::Class
uses SQL::Abstract::Classic since 0.082842 and no longer this module,
DBIO (a DBIx::Class fork) builds on SQL::Abstract 2.x and
SQL::Abstract::Tree; the "SQL::Abstract developers" link now points
at our own SUPPORT section instead of DBIx::Class, and SEE ALSO
lists DBIO and SQL::Abstract::Classic
- Docs: new "CAVEAT: untrusted input in ORDER BY" section - order by
columns are identifiers, not bind values, so map user input onto an
allow-list (and set quote_char) instead of passing it through
(RT#117059)
- SQL::Abstract::Tree: an empty placeholder_surround (or one with only
a left part) fills in placeholders without "Use of uninitialized
value $left / $right" warnings (RT#117234)
- Docs: the literal SQL examples no longer use the deprecated
operator-inside-the-literal style: -ident for column comparisons,
{ "=" => \[ ... ] }, { -in => \[ $sub_stmt, @sub_bind ] } and
{ ">" => \[ "ALL (...)", ... ] } for subqueries (with the real bind
order); the special_ops and unary_ops sections show how the defined
operator is used, and unary_ops handlers are documented to return
($sql, @bind) (RT#127116, KES)
- Docs: where() is documented as where($where, $order) like select(), with
hashref and arrayref examples; the WHERE CLAUSES introduction and the
logic option say how the @where array examples are passed (\@where),
and the "pending%" OR example has balanced parenthesis and the real
bind order (RT#127117, KES)
- An undef element in an -in / -not_in list no longer dies with the
"!!!AUDIT YOUR CODE AND DATA!!!" exception; it now renders the
logically correct SQL that exception promised:
( col IN (...) OR col IS NULL ) and
( col NOT IN (...) AND col IS NOT NULL ) (RT#127356)
- SQL::Abstract::Tree: quoted strings and identifiers ('...', "...",
`...`) are no longer split up at the commas, parenthesis, whitespace
or keywords inside them. A Postgres range literal such as '(]' no
longer dies with "missing closing ')'", and 'a,b' is no longer
reformatted as 'a, b' (RT#132994, RT#105625)
- SQL::Abstract::Tree: an unknown operator followed by a function call
(foo <@ tstzrange(...)) next to an AND/OR is kept as one operand
instead of getting an AND/OR inserted after the operator
- New constructor option array_as_in: renders col => [ 1, 2, 3 ] as
col IN ( ?, ?, ? ) instead of a chain of OR-ed equalities (much
faster on MySQL for long lists); undef elements become an extra
OR col IS NULL. Off by default, and only applied where the meaning
is identical (RT#156818)
- Docs/metadata: now maintained by Torsten Raudssus; support moved from
the DBIx::Class mailing list to IRC #dbio on irc.perl.org (also in
META x_IRC); dropped the dead git.shadowcat.co.uk repository links in
favour of GitHub; updated Nathan Wiger's contact address; META author
is now the maintainer; added a COPYRIGHT section
- t/05in_between.t: the subclass test packages no longer use the
`package NAME { ... }` syntax (perl 5.14+) or `use mro`/`use parent`,
so the test suite compiles and passes on perl 5.8 - 5.12 again
- SQL::Abstract::Parts: drop the leftover `use Module::Runtime`. It was
never called, and Module::Runtime stopped being a prerequisite in
2.000001, so on a system without it installed loading Parts.pm (and
hence the whole render path that builds Parts objects) died at compile
time
- SQL::Abstract::Tree: pad_keyword() no longer emits "Use of
uninitialized value" warnings when a caller supplies an indentmap
without a newline (it now guards newline the way _unparse already
does)
- SQL::Abstract::Tree: a (NOT) BETWEEN now parses both of its bounds
into a single AND grouped under the BETWEEN node
(BETWEEN[val, AND[low, high]]) instead of letting the upper bound
leak out as a sibling in the enclosing expression. The re-parse that
was meant to do this never fired, because it compared an arrayref
node against the string '-LITERAL'. Emitted SQL text round-trips
unchanged; only the parsed tree (parse()) is affected.
- select() now dies when given more than the four positional arguments
(source, fields, where, order) instead of rendering garbage SQL from a
flat clause list that was meant to be a hashref (RT#148271, Ovid)
- ExtraClauses: -join accepts the dashed spellings -as / -on / -using /
- type / -to / -from like the surrounding from_list does, and dies on
an unknown key instead of silently dropping it (RT#148271, Ovid)
- SQL::Abstract::Tree: recognise Oracle's MINUS as an expression start
keyword, like EXCEPT (RT#134245, DAMI)
- SQL::Abstract::Tree: anchor the unrollable-operator regex so that ON
no longer matches inside function names such as GROUP_CONCAT or
CONCAT_WS and strips their parenthesis on unparse/format
(RT#105563, RT#117234)
- An undef element in a -row (and so in -values and the ExtraClauses
insert rowvalues clause) is now a NULL bind instead of being silently
dropped, which lost placeholders and bind values in bulk inserts
(RT#137357)
- Add regression coverage confirming an empty arrayref given to -and /
- or in a where clause emits no SQL and no trailing AND/OR (correct
since the v2 engine; locks it against regressions) (RT#126990, GH#15,
fabzzap)
- Document that the bundled DBIx::Class::* helper modules require
DBIx::Class at runtime (intentionally not a prereq, to avoid a
dependency cycle)
- Document the limits of the default injection_guard and the safe
handling of untrusted input (bind values, quote_char) (RT#117059)
- generate() in scalar context now interpolates each placeholder
exactly once, so a bind value that contains a '?' no longer
swallows the following bind values
- Reword the "removed in 2.0" deprecation warnings to "a future
version", since those code paths still ship in the 2.x line
- Do not warn when a plain hashref is passed as a bind value to
insert() - this is how Postgres json/jsonb columns are supplied
(GH#18, RT#120676, kraih)
- Speed up the top-level special-op check with a single precompiled
regex instead of a List::Util::first scan (GH#21, larryl)
- Fix ExtraClauses POD NAME/synopsis to the real package name and
the documented plugin('+ExtraClauses') usage
- Correct the 'pending%' bind value in the -like POD example
(GH#24, lucas1)
- SQL::Abstract::Tree: preserve a real 0 / '0' bind value in
fill_in_placeholder() instead of blanking it (was `|| ''`)
(RT#125760)
- Add DBIx::Class::SQLMaker::Role::SQLA2Passthrough to Makefile.PL
no_index so the proof-of-concept role is not indexed under
SQL-Abstract on CPAN
- Refactor subclass method override grandfathering system
- Remove old SQLA::More compat code (will restore a better set later)
- Fix for empty 'order by' to ->select (dakkar)
- Remove vestigial possibly-special-op name conversion, which stopped
special_ops regexes matching op names containing underscores (RT#143837)
- Fixes for _where_field_IN/BETWEEN overrides (jjatria)
- Correctly handle literal passed to insert from/values key
- Make puke() and belch() methods, ala the SQLA::Classic change
- Syntax error fixes for 5.8 from ilmari
* Sun Jan 24 2021 Tina Müller <timueller+perl@suse.de>
- updated to 2.000001
see /usr/share/doc/packages/perl-SQL-Abstract/Changes
2.000001 - 2021-01-23
- Remove Module::Runtime requirement
2.000000 - 2021-01-21
- Collapse custom join conditions back to something DBIC might understand
1.90_03 - 2019-10-13
- Add proof of concept DBIx::Class::SQLMaker::Role::SQLA2Passthrough
- _where_field_IN/BETWEEN are documented as subclassable; feature restored
1.90_02 - 2019-10-12
- fix DBIC ident op expander compat wrapper to handle call as unop
1.90_01 - 2019-10-09
- Complete overhaul of the internals, see the SQL::Abstract::Reference
docs to understand the new implementation's affordances.
* Tue Jun 02 2020 Tina Müller <timueller+perl@suse.de>
- updated to 1.87
see /usr/share/doc/packages/perl-SQL-Abstract/Changes
1.87 - 2020-06-02
- Add runtime dependency on Test::Deep and Test::Builder::Module for
SQL::Abstract::Test (RT#131623)
* Tue Jul 10 2018 coolo@suse.com
- updated to 1.86
see /usr/share/doc/packages/perl-SQL-Abstract/Changes
1.86 - 2018-07-09
- Remove obsolete documentation about arrayrefref as the $source
argument for ->select (removed in version 1.74)
- Factor out the field list part of SELECT for subclassability (GH#13)
- Do not replace literal '0' with empty string in WHERE clauses (GH#14)
* Wed Jan 31 2018 coolo@suse.com
- updated to 1.85
see /usr/share/doc/packages/perl-SQL-Abstract/Changes
1.85 - 2018-01-27
- Restore perl version requirement missed in the Distar port
- Factor out the SET ... part of UPDATE for subclassability (GH#12)
* Tue Apr 04 2017 coolo@suse.com
- updated to 1.84
see /usr/share/doc/packages/perl-SQL-Abstract/Changes
1.84 - 2017-04-03
- Restore 'dynamic_config => 0' missed in the Distar port
1.83 - 2017-04-03
- Support for DELETE ... RETURNING (GH#9)
- Port to Distar
* Tue Mar 21 2017 coolo@suse.com
- updated to 1.82
see /usr/share/doc/packages/perl-SQL-Abstract/Changes
revision 1.82 2017-03-20
- ------------------------
- Add explicit dependency on Sub::Quote (GH#8)
- Fix syntax errors in ORDER BY docs (GH#7)
revision 1.81_01 2017-02-28
- ---------------------------
- Fix order clauses with bind parameters in ->where
- Fix ->insert($table, \@values) with >26 values (RT#112684)
- Teach ::Tree that ILIKE (PostgreSQL) and REGEXP (MySQL) are binary ops
- Support for UPDATE ... RETURNING
- Documentation improvements for ORDER BY
* Wed Nov 12 2014 coolo@suse.com
- updated to 1.81
- Fix overly-enthusiastic parenthesis unroller (RT#99503)
revision 1.80 2014-10-05
- ---------------------------
- Fix erroneous behavior of is_literal_value($) wrt { -ident => ... }
- Explicitly croak on top-level special ops (they didn't work anyway)
revision 1.79 2014-09-25
- ---------------------------
- New exportable functions: is_literal_value($) and is_plain_value($)
- New attribute 'escape_char' allowing for proper escape of quote_chars
present in an identifier
- Deprecate { "" => \... } constructs
- Treat { -value => undef } as plain undef in all cases
- Explicitly throw on { -ident => undef }
* Mon Sep 15 2014 coolo@suse.com
- updated to 1.78
- Fix parsing of binary ops to correctly take up only a single LHS
element, instead of gobbling up the entire parse-to-date
- Explicitly handle ROW_NUMBER() OVER as the snowflake-operator it is
- Improve signatures/documentation of is_same_sql_bind / eq_sql_bind
- Retire script/format-sql - the utility needs more work to be truly
end-user convenient
* Mon Feb 24 2014 coolo@suse.com
- updated to 1.77
- Reintroduce { -not => undef } column operator (regression from 1.75)
- *UPCOMING INCOMPATIBLE BUGFIX*: SQLA used to generate incorrect SQL
on undef-containing lists fed to -in and -not_in. An exception will
be raised for a while before properly fixing this, to avoid quiet
but subtle changes to query results in production
- Deprecate and warn when supplying an empty arrayref to like/not_like
operators (likely to be removed before 2.0)
- Warn when using an inequality operator with a multi-value array to
arrive at what amounts to a 1=1 condition (no pre-2.0 plans to fix
this behavior due to backwards comp concerns)
- Fix false negative comparison of ORDER BY <function> ASC
- More improvements of incorrect parsing (placeholder at end of list
element)
- Fix typos in POD and comments (RT#87776)
- Augment -not_bool example with nesting (RT#89601)
/usr/lib/perl5/vendor_perl/5.44.0/DBIx /usr/lib/perl5/vendor_perl/5.44.0/DBIx/Class /usr/lib/perl5/vendor_perl/5.44.0/DBIx/Class/SQLMaker /usr/lib/perl5/vendor_perl/5.44.0/DBIx/Class/SQLMaker/Role /usr/lib/perl5/vendor_perl/5.44.0/DBIx/Class/SQLMaker/Role/SQLA2Passthrough.pm /usr/lib/perl5/vendor_perl/5.44.0/DBIx/Class/Storage /usr/lib/perl5/vendor_perl/5.44.0/DBIx/Class/Storage/Debug /usr/lib/perl5/vendor_perl/5.44.0/DBIx/Class/Storage/Debug/PrettyPrint.pm /usr/lib/perl5/vendor_perl/5.44.0/SQL /usr/lib/perl5/vendor_perl/5.44.0/SQL/Abstract /usr/lib/perl5/vendor_perl/5.44.0/SQL/Abstract.pm /usr/lib/perl5/vendor_perl/5.44.0/SQL/Abstract/Formatter.pm /usr/lib/perl5/vendor_perl/5.44.0/SQL/Abstract/Parts.pm /usr/lib/perl5/vendor_perl/5.44.0/SQL/Abstract/Plugin /usr/lib/perl5/vendor_perl/5.44.0/SQL/Abstract/Plugin/BangOverrides.pm /usr/lib/perl5/vendor_perl/5.44.0/SQL/Abstract/Plugin/ExtraClauses.pm /usr/lib/perl5/vendor_perl/5.44.0/SQL/Abstract/Reference.pm /usr/lib/perl5/vendor_perl/5.44.0/SQL/Abstract/Role /usr/lib/perl5/vendor_perl/5.44.0/SQL/Abstract/Role/Plugin.pm /usr/lib/perl5/vendor_perl/5.44.0/SQL/Abstract/Test.pm /usr/lib/perl5/vendor_perl/5.44.0/SQL/Abstract/Tree.pm /usr/share/doc/packages/perl-SQL-Abstract /usr/share/doc/packages/perl-SQL-Abstract/Changes /usr/share/doc/packages/perl-SQL-Abstract/README /usr/share/doc/packages/perl-SQL-Abstract/SECURITY.md /usr/share/doc/packages/perl-SQL-Abstract/examples /usr/share/doc/packages/perl-SQL-Abstract/examples/bangdbic.pl /usr/share/doc/packages/perl-SQL-Abstract/examples/console.pl /usr/share/doc/packages/perl-SQL-Abstract/examples/dbic-console.pl /usr/share/doc/packages/perl-SQL-Abstract/examples/sqla-format /usr/share/doc/packages/perl-SQL-Abstract/examples/sqla2passthrough.pl /usr/share/licenses/perl-SQL-Abstract /usr/share/licenses/perl-SQL-Abstract/LICENSE /usr/share/man/man3/DBIx::Class::SQLMaker::Role::SQLA2Passthrough.3pm.gz /usr/share/man/man3/DBIx::Class::Storage::Debug::PrettyPrint.3pm.gz /usr/share/man/man3/SQL::Abstract.3pm.gz /usr/share/man/man3/SQL::Abstract::Plugin::BangOverrides.3pm.gz /usr/share/man/man3/SQL::Abstract::Plugin::ExtraClauses.3pm.gz /usr/share/man/man3/SQL::Abstract::Reference.3pm.gz /usr/share/man/man3/SQL::Abstract::Role::Plugin.3pm.gz /usr/share/man/man3/SQL::Abstract::Test.3pm.gz /usr/share/man/man3/SQL::Abstract::Tree.3pm.gz
Generated by rpm2html 1.8.1
Fabrice Bellet, Sun Nov 8 22:32:19 2026