Home Search Pricing Get inErrata About

Sign in Sign up

Graph/sql-filtering-semantics-drift

AntiPattern

SQL Filtering Semantics Drift

sql-filtering-semantics-drift

Database queries fail to filter correctly because predicates, identity boundaries, and subquery/partition logic are mixed across layers (auth vs data) or written with non-equivalent SQL shapes, leading to missed/extra rows and brittle performance on joins and LIMIT/IN rewrites.

Node Details

Public graph metadata

Updated7/7/2026

Connections

30 linked nodes

MATCHESSolution

Use UPDATE ... WHERE id IN (SELECT id FROM ... LIMIT $n) pattern. — The subquery selects the IDs with LIMIT, and the outer UPDATE targets only those rows. Tension: All filter predicates go in the inner SELECT. Outcome: Parameters are passed positionally ($1, $2, etc.) and the LIMIT parameter goes last.

MATCHESSolution

you may need to adjust your logic or dependencies in the enabled property — If you want "barney 0.5" to be logged every time useQuery is executed. Outcome: ensure it reflects the desired behavior.

MATCHESSolution

Define services as JSONB — using SQLAlchemy and PostgreSQL. Tension: I need to filter results based on a value in a JSON array column. Outcome: query = query.filter(professional_model.Professional.services.op('@>')(cast(func.to_jsonb([filters['services']]), JSONB))).

MATCHESSolution

LEFT JOIN both, fail only if both are NULL — validation predicate. Tension: must have privacy_events row OR a redaction_findings row with empty findings array. Outcome: `LEFT JOIN privacy_events pe ON ... LEFT JOIN redaction_findings rf ON rf.source_table=... AND rf.source_id=... AND jsonb_array_length(rf.findings)=0 WHERE pe.id IS NULL AND rf.id IS NULL`.

MATCHESSolution

the existing validate.ts had four hand-built UNION ALL queries hardcoding q/a/c/kr — For the SQL refactor itself. Tension: each query has different per-table column projections. Outcome: The cleanest pattern.

MATCHESSolution

either (a) drop the param from the array when the clause is omitted — when building SQL with optional clauses. Tension: requires dynamic position recomputation, error-prone. Outcome: (b) is safer for most cases.

MATCHESSolution

More complex, multi-statement queries, or things like `insert..on conflict` and `merge`.

MATCHESSolution

Drop ORDER BY when there's no LIMIT. Tension: Salience ordering only matters when you're picking the top-K. Outcome: for an unlimited stream you're keeping every record anyway, so the sort is pure cost.

MATCHESSolution

If you only wanted to provide a single index for all queries instead — all three queries have in common. Tension: I doubt the DBMS would use the index. Outcome: then you'd index the type.

MATCHESSolution

You need dynamic SQL to do this properly. — in PostgreSQL, I am trying to have SQL which orders by multiple columns. Tension: You cannot switch those per value of a column or parameter input in a prepared statement.

MATCHESSolution

Try to perform a hybrid search. — All vector databases offer the hybrid search functionality. Tension: Hybrid search is a technique that combines multiple search algorithms to improve the accuracy and relevance of search results. Outcome: set the `alpha` parameter as a way to give a weight to these two.

MATCHESSolution

Avoid analytic/window functions and instead use a non-analytic query pattern (e.g., JOIN/EXISTS/NOT EXISTS or set logic) to implement the 'r excluding IDs with h; include h-only IDs' requirement; also verify the Denodo Connection adapter and delegate-analytic-functions configuration if analytic functions are still needed.

MATCHESSolution

The best thing you can do would be to do two separate queries — and then join them in your application layer or something. Tension: you cannot achieve this. Outcome: join them in your application layer or something.

MATCHESSolution

Define a composite type (e.g., with bigint fields) and cast/select the scalar subquery results into that type to return a single composite row.

MATCHESSolution

Personally I would go for this: — the below query is timing out due to large data set. Tension: you really should provide the full EXPLAIN ANALYZE result otherwise we're just flying blind and guessing here.

MATCHESSolution

Do not pass untrusted user input to `DataFrame.query()` (treat it as unsafe as `eval()`); instead use safe filtering approaches or restrict inputs to trusted string literals/validated expressions rather than attempting to patch/override `query()`.

MATCHESSolution

Avoid `select('*')` and instead explicitly select only the allowed columns (e.g., `select('public_col1, public_col2')`), or otherwise restrict exposure via backend/database controls.

MATCHESSolution

Create a controlled DSL, validate allowed fields and operators, and build the query back using parameterization

MATCHESSolution

Determine the requesting user’s team, then filter queries by matching the data creator’s user_team to that team (e.g., by joining data with the users table and applying a team_id/user_team predicate, with admin bypass as needed).

MATCHESSolution

use `Seqlelize.Op.eq` to prevent SQL injection — I'm using nodejs, express and sequlize to display a form and save it to a databse. Tension: or should some other technique (such as normalize) also be used? Outcome: Also is there something else I need to watch out for?

MATCHESSolution

if you use derived queries.

MATCHESSolution

Ensure the parameter type matches the indexed column (use VARCHAR parameter types or explicitly CAST/CONVERT the parameter/column to VARCHAR in the predicate). After type alignment, the query should use the nonclustered index and revert to the lighter, seek-based locking behavior.

MATCHESSolution

Rewrite the traversal to reduce the number of OR branches—e.g., filter using a single predicate by combining the pair fields and applying `within` (or otherwise restructure into a simpler condition such as building a set of allowed pairs).

MATCHESSolution

the solution shown below — exceeding the SQL parameter limit. Tension: Each batch is queried separately, and the results are collected, sorted, and then paginated on the Java side. Outcome: batching the viewerIds list into smaller chunks of 2100 IDs or less.

MATCHESSolution

In this method. Outcome: the filter and subfilter have to be set.

MATCHESSolution

Cast :from and :to to timestamp in the query, or build the filters dynamically with Spring Specifications or QueryDSL

MATCHESSolution

you can use subqueries like this: — if you plan to remove that to support non-unique names. Tension: Although this can be a bit slow, so make sure you have the indexes setup.

MATCHESSolution

Drizzle supports this cleanly with `or()` + `isNull()` — Drizzle ORM. Tension: no raw SQL needed. Outcome: const rows = await db.select().from(questions).where( or( eq(questions.tenantId, tenantId), isNull(questions.tenantId) ) );.

MATCHESSolution

Create partial indexes for public and tenant rows, and use bitmap OR scan

MATCHESSolution

backwards compatibility with persisted legacy data. Tension: indexes are positions; positions are not identity.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata