fix parameter binding order (#825)

* use numbered parameters in sqlite

* implement parameter deduplication

* implement parameter re-duplication for mysql

* Improve error messages on invalid sqlpage function calls. The messages now contain actionable advice.

* simplify extract_set_variable

Author: lovasoa

CHANGELOG.md

@@ -6,6 +6,12 @@
 - Fix a bug with date sorting in the table component.
 - Center table descriptions.
 - Fix a rare crash on startup in some restricted linux environments.
+- Fix a rare but serious issue when on SQLite and MySQL, some variable values were assigned incorrectly
+  - `CASE WHEN $a THEN $x WHEN $b THEN $y` would be executed as `CASE WHEN $a THEN $b WHEN $x THEN $y` on these databases.
+  - the issue only occured when using in case expressions where variables were used both in conditions and results.
+- Implement parameter deduplication.
+  Now, when you write `select $x where $x is not null`, the value of `$x` is sent to the database only once. It used to be sent as many times as `$x` appeared in the statement.
+- Improve error messages on invalid sqlpage function calls. The messages now contain actionable advice.
 
 ## 0.33.0 (2025-02-15)
 

src/webserver/database/mod.rs

@@ -9,7 +9,9 @@ mod syntax_tree;
 mod error_highlighting;
 mod sql_to_json;
 
-pub use sql::{make_placeholder, ParsedSqlFile};
+pub use sql::ParsedSqlFile;
+use sql::{DbPlaceHolder, DB_PLACEHOLDERS};
+use sqlx::any::AnyKind;
 
 pub struct Database {
     pub connection: sqlx::AnyPool,
@@ -34,3 +36,16 @@ impl std::fmt::Display for Database {
         write!(f, "{:?}", self.connection.any_kind())
     }
 }
+
+#[inline]
+#[must_use]
+pub fn make_placeholder(db_kind: AnyKind, arg_number: usize) -> String {
+    if let Some((_, placeholder)) = DB_PLACEHOLDERS.iter().find(|(kind, _)| *kind == db_kind) {
+        match *placeholder {
+            DbPlaceHolder::PrefixedNumber { prefix } => format!("{prefix}{arg_number}"),
+            DbPlaceHolder::Positional { placeholder } => placeholder.to_string(),
+        }
+    } else {
+        unreachable!("missing db_kind: {db_kind:?} in DB_PLACEHOLDERS ({DB_PLACEHOLDERS:?})")
+    }
+}