From 6dbf2f96759b9be8123c216ed3fb3a535d032f7b Mon Sep 17 00:00:00 2001 From: Dillard Blom Date: Wed, 30 Sep 2026 17:26:01 +0200 Subject: [PATCH] Ignore trailing comments when splitting SQL batches A comment after the last semicolon ("SELECT 1; -- note") became a statement of its own. It is not a read, so the whole batch asked for confirmation and the comment was then sent to the database. Drop parts that contain only comments. --- lib/Service/SqlGuard.php | 3 ++- tests/Unit/Service/SqlGuardTest.php | 4 ++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/lib/Service/SqlGuard.php b/lib/Service/SqlGuard.php index 392b415..e9e5990 100644 --- a/lib/Service/SqlGuard.php +++ b/lib/Service/SqlGuard.php @@ -87,8 +87,9 @@ class SqlGuard $statements[] = trim($current); + // A trailing comment ("SELECT 1; -- note") is not a statement return array_values(array_filter($statements, function ($s) { - return $s !== ''; + return trim(self::removeComments($s)) !== ''; })); } diff --git a/tests/Unit/Service/SqlGuardTest.php b/tests/Unit/Service/SqlGuardTest.php index 9c23193..38da012 100644 --- a/tests/Unit/Service/SqlGuardTest.php +++ b/tests/Unit/Service/SqlGuardTest.php @@ -167,6 +167,10 @@ class SqlGuardTest extends TestCase ["/* it's; here */ SELECT 1; SELECT 2", ["/* it's; here */ SELECT 1", 'SELECT 2']], ['SELECT \$1; SELECT 2', ['SELECT \$1', 'SELECT 2']], [' ; ;SELECT 1;', ['SELECT 1']], + ["SELECT 1; --full", ['SELECT 1']], + ["SELECT 1; -- note\nSELECT 2", ['SELECT 1', "-- note\nSELECT 2"]], + ["-- only a comment", []], + ["SELECT 1; /* note */", ['SELECT 1']], ]; }