Files
cobble/src/functions/backend/database/quote-sql-identifier.ts
T
tben 41bb4aaac2 Let a super admin read the database from the app
A new super admin settings page, /admin/settings/database, lists every
table with its record count and size, and one page of the open table's
records newest key first. Values are cut inside SQL (400 characters, with
a flag saying so) and a record opens whole in a modal, so a table of long
texts reads without shipping it all. A search matches every column's
text, word by word or as a phrase, which is the one thing that also works
on a virtual table. Nothing in it writes: the catalog, the records and
the single record are all reads, GET only.
2026-10-23 06:03:42 +01:00

10 lines
432 B
TypeScript

/**
* Quotes a table or column name for SQL, wrapping it in double quotes and
* doubling any it holds. The database browser builds its statements from
* the database's own names, and every one of them still goes through here
* so a name with a quote or a space in it can't break out of the query.
*/
export default function quoteSqlIdentifier({ name }: { name: string }): string {
return `"${name.replace(/"/g, `""`)}"`;
}