如何判断一个SQL查询是否是一个SELECT？
早上好。
编辑
我想对 sql 查询进行一些验证，以验证此查询是 SELECT 而不是 UPDATE 或 DELETE 或 INSERT 或任何 sql 奇怪的语句。
我知道最简单的方法是匹配“^SELECT”但是：
查询可以以“(”开头，例如
(SELECT * FROM blah WHERE id > 1 LIMIT 3) UNION (SELECT * ...)
查询可以以“WITH RECURSIVE”开头
WITH RECURSIVE cte AS (SELECT * FROM blah)
我想确定 SQL 查询是否是 SELECT。 好吧，我不知道在编写正则表达式之前是否必须知道一些奇怪的查询。
任何帮助表示赞赏。
编辑：我想检查它是否是 PURE Select 查询:)
Morning SO.
EDIT
I would like to do some validation on sql queries to verify that this query is a SELECT and not an UPDATE or a DELETE or an INSERT or any sql weird statement.
I know that the easiest way is to match "^SELECT" BUT :
a query can start with "(" like
(SELECT * FROM blah WHERE id > 1 LIMIT 3) UNION (SELECT * ...)
a query can start with " WITH RECURSIVE "
WITH RECURSIVE cte AS (SELECT * FROM blah)
I Would like to determine if a SQL query is a SELECT.
Well I don't know if there is some weird queries I have to know before writing a regexp.
Any help is appreciated.
EDIT: I want to check if it's a PURE Select query :)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
处理此问题的正常方法是使用权限 - 您授予在 sql server 中运行查询的用户 db_reader 权限，但不授予 db_writer 或其他任何权限。然后，如果查询失败，则处理错误/异常。
The normal way to handle this is with permissions - you grant the user running the query db_reader permissions in sql server, but not db_writer or anything else. Then you handle the error/exception if the query fails.
您还可以制作更新语句，在内部运行自己的 SELECT 来查找要更新的数据，或者使用许多其他方式将语句嵌入到彼此中...假设您不使用“SELECT”作为数据或字段名称，只需运行正则表达式对于
/\bselect\b/i否则你将需要一个完整的解析器。编辑：还有：
/\b(insert|update)\b/i反转它以确保其中没有它们。You can also make update statemtents that run their own SELECTs inside to find out data to update, or many other ways to embed statements into eachother... Assuming you don't use "SELECT" as data or field-names just run a regex for
/\bselect\b/iotherwise you will need a full blown parser.Edit: also:
/\b(insert|update)\b/iinvert that to make sure there are none of them in it.如果查询以单词“select”（不区分大小写）开头，那么它是一个选择查询
if query starts by word "select" (case insensitive) then it's a select query