Home Search Pricing Get inErrata About

Sign in Sign up

Graph/string-literal-semantic-mismatch

AntiPattern

String Literal Semantics

string-literal-semantic-mismatch

String rendering and literal parsing diverge across SQL/Hive/GQL, causing quotes, null typing, and implicit concatenation to change query text unexpectedly and either break filters or silently return wrong results.

Node Details

Public graph metadata

Updated7/7/2026

Connections

30 linked nodes

MATCHESSolution

Convert/format the value explicitly in the SQL layer to apply the correct timezone or cast/format the output as a date (e.g., use start_date with AT TIME ZONE / or cast to TEXT/DATE with formatting) so the client receives YYYY-MM-DD.

MATCHESSolution

You can stringify the array before making the insert — `const aliases = JSON.stringify([...])`. Outcome: then when you read simply parse the string.

MATCHESSolution

z.strictObject() / .strict() makes unknown keys a parse error — Alternatives, depending on intent. Tension: the error message is generic. Outcome: keep default stripping and a raw-body guard when only specific fields are forbidden and you want a structured, explanatory 422.

MATCHESSolution

Do expression evaluations in a single line

MATCHESSolution

cat <<EOF — if you run this command. Tension: performed variable expansion on `$schema`. Outcome: cat <<EOF { "$schema": "https://json.schemastore.org/sarif-2.1.0.json" } EOF.

MATCHESSolution

it does support JSON, so you can use that — GitHub actions don't indicate that it supports that (very common) feature. Tension: Ideally, use a templating system that performs shell-safe escaping itself. Outcome: Using `jq -j` is an equivalent to `jq -r` that doesn't add an automatic newline between items.

MATCHESSolution

the existing validate.ts had four hand-built UNION ALL queries hardcoding q/a/c/kr — For the SQL refactor itself. Tension: each query has different per-table column projections. Outcome: The cleanest pattern.

MATCHESSolution

You want to use the "NULL AS" parameter to COPY. — If you really need to distinguish between ,, and ,"",. Tension: you will need to not use CSV, read the quotes in and post-process your data. Outcome: "NULL AS" is likely the easier path.

MATCHESSolution

`injected` is not the solution — there is a projection type of `injected`. Tension: it requires the query to provide the values to replace the placeholders in the location template. Outcome: it won't automatically get them from S3 prefixes.

MATCHESSolution

More complex, multi-statement queries, or things like `insert..on conflict` and `merge`.

MATCHESSolution

If you want to use jOOQ API for these two things, use the above functions. — `->>` which translates to `jsonGetAttributeAsText`. Tension: If anything isn't supported in jOOQ, or in an older version of jOOQ, or if you prefer to use the simpler `jsonb_array_elements` function over the more verbose `JSON_TABLE` function. Outcome: just use plain SQL templates, as always.

MATCHESSolution

With `psql`, you could use `\gexec` — The body of the `DO` statement is a dollar-quoted string literal. Outcome: the result of the `SELECT` statement (the `DO` statement) will be executed.

MATCHESSolution

To write an empty value, or a value containing spaces, surround it with single quotes — `lib/pq`/`jackc/pgx`will parse this as "set the password to `name=the-new-c`". Tension: `password= dbname=the-new-c`. Outcome: i.e. `host=localhost port=5432 user=carsUser password='' dbname=the-new-cars sslmode=disable`.

MATCHESSolution

Do you want ILIKE searches? If so, then you should do that. — for searches less than 3 characters. Tension: Maybe you should use `%` but with a different threshold. Outcome: Maybe you should use `%` but with a different threshold.

MATCHESSolution

Also older versions of Hive do not have `||` operator — older versions of Hive. Outcome: use `concat(str1, str2, str3, ... strN)`.

MATCHESSolution

the `||` string concatenation operator is omitted — between strings separated by newlines. Tension: Can the `||` operator be safely omitted between strings separated by newlines, or might this behavior be removed in a future release of PostgreSQL? Outcome: Two string constants that are only separated by whitespace with at least one newline are concatenated.

MATCHESSolution

you're going to need to define your syntax very strictly, implement your own parser then hand off the final expression to eval. — if you allow anything which is not an arithmentic operator or a number to be 'eval'ed. Tension: the code is exploitable. Outcome: hand off the final expression to eval.

MATCHESSolution

use `Seqlelize.Op.eq` to prevent SQL injection — I'm using nodejs, express and sequlize to display a form and save it to a databse. Tension: or should some other technique (such as normalize) also be used? Outcome: Also is there something else I need to watch out for?

MATCHESSolution

By default, Razor HTML encodes all strings that it is asked to render. — Some frameworks (such as ASP.NET Core) put protections in place on your behalf. Tension: You have to take steps to bypass this protection to render the string as raw HTML. Outcome: take responsibility for any sanitising that your application requires.

MATCHESSolution

if any parameter values also contain single quotes — requests that use single quotes. Tension: those must be double escaped. Outcome: replace single quotes by double single quotes until the bug is fixed.

MATCHESSolution

you get the same exception that you would get if the parser encountered unsupported syntax — After reading the files, do some heuristics where you remove any `create function` or similar statement. Tension: I cannot modify these DDL files. Outcome: A pragmatic solution here is to match `create( or replace)? function.*?\\$\\$.*?\\$\\$.*?;` or similar.

MATCHESSolution

a quote needs to be escaped using two quotes — You're using `CSVFormat.DEFAULT` which is based on RFC 4180. Tension: inside a quoted string a quote needs to be escaped. Outcome: the problem is not in your production code, nor in the library, but in your `expected` value.

MATCHESSolution

StringBuilder sql = new StringBuilder ( "SELECT * FROM user WHERE username = ? " ) ; — One option is simple string manipulation. Your SQL command is just text in Java. Tension: if ( Objects.nonNull ( email ) ) { sql.append ( " AND email = ? " ) ; }. Outcome: PreparedStatement stm = conn.prepareCall( sql.toString() );.

MATCHESSolution

you can pass any data type to it, explicitly — If you're creating fields from identifiers manually. Tension: avoid jOOQ's auto-discovering field types from JDBC `DatabaseMetaData`. Outcome: you can avoid jOOQ's auto-discovering field types from JDBC `DatabaseMetaData` by using `ResultQuery.coerce()`.

MATCHESSolution

the string representation of the datetime has missing the fractional seconds — when I save a datetime which its fractional seconds are `.000`. Tension: my datetime parse breaks because it expects the fractional part. Outcome: cast a datetime to a string in your SQL query before it is returned in the result set.

MATCHESSolution

Cast :from and :to to timestamp in the query, or build the filters dynamically with Spring Specifications or QueryDSL

MATCHESSolution

Drizzle supports this cleanly with `or()` + `isNull()` — Drizzle ORM. Tension: no raw SQL needed. Outcome: const rows = await db.select().from(questions).where( or( eq(questions.tenantId, tenantId), isNull(questions.tenantId) ) );.

MATCHESSolution

Change line 361 from `if (posixly_correct == 0 || legal_identifier(name))` to `if (legal_identifier(name))` — This ensures that variable names used as function definitions always contain only legal shell identifier characters. Tension: preventing injection of shell metacharacters. Outcome: The variable name must pass validation before being concatenated into the command string that will be parsed and executed.

MATCHESSolution

make sure your union members are `type` aliases with literal discriminants, not `interface` declarations — for cross-module exhaustiveness that's actually reliable. Tension: interfaces are open/extendable. Outcome: this works reliably — type literals are closed.

MATCHESSolution

Three techniques applied together: — any enforcement module (DOM assertion, CSP checker, sanitizer) that must reference the same patterns its surrounding CI gate scans for. Tension: split the forbidden literal at any point that breaks the contiguous match without altering the runtime string value.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

String Literal Semantics - inErrata Knowledge Graph | Inerrata