jiwen624 commented on PR #56558:
URL: https://github.com/apache/spark/pull/56558#issuecomment-6552199215
Gentle ping @cloud-fan.
Also @uros-b, I noticed you've reviewed several JDBC PRs recently. Could you
take a look at this one too?
**In short**: when a string value containing a backslash is pushed down to
MySQL, MySQL reads the backslash as an escape character (in MySQL's default
sql_mode). This causes:
- **Silent wrong results**: `df.filter($"s" === "C:\\temp")` returns no
rows even though a matching row exists.
- **SQL injection**: a value like `x\' OR 1=1) #` breaks out of the string
literal and returns the whole table.
This PR extends the SPARK-57332 fix from LIKE patterns to all pushed-down
string values. It also makes the fix work in every sql_mode, including
NO_BACKSLASH_ESCAPES.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
