alasql 0.7.0 → 1.7.3

package/.github/workflows/nodejs.yml

@@ -13,7 +13,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [10.x, 12.x, 14.x, 15.x]
+        node-version: [12.x, 14.x, 15.x]
 
     steps:
     - uses: actions/checkout@v2

package/.husky/pre-commit

@@ -0,0 +1,4 @@
+#!/bin/sh
+. "$(dirname "$0")/_/husky.sh"
+
+npm test

package/README.md

@@ -1,3 +1,7 @@
+<h2>
+Please use version 1.x as prior versions has a security flaw if you use user generated data to concat your SQL strings instead of providing them as a parameters to AlaSQL. 
+</h2>
+
 _AlaSQL is an open source project used on more than two million page views per month - and we appreciate any and all contributions we can get. [Please help out](https://github.com/agershun/alasql/labels/Please%20help%20out%21)._
 
 _Have a question? Ask on [Stack Overflow](http://stackoverflow.com/questions/ask?tags=AlaSQL) using the "alasql" tag._
@@ -23,9 +27,7 @@ _Have a question? Ask on [Stack Overflow](http://stackoverflow.com/questions/ask
 <h2 align="center"><a href="http://alasql.org"><img src="https://cloud.githubusercontent.com/assets/1063454/19309516/94f8007e-9085-11e6-810f-62fd60b42185.png" alt="AlaSQL logo" styl="max-width:80%"/></a>
 </h2>
 
-<h2>
-Please use version 0.7 - prior versions has a security flaw if you concat your SQL strings instead of providing them as a parameter to AlaSQL. 
-</h2>
+
 
 AlaSQL - _( [à la](http://en.wiktionary.org/wiki/%C3%A0_la) [SQL](http://en.wikipedia.org/wiki/SQL) ) [ælæ ɛskju:ɛl]_ - is an open source SQL database for JavaScript with a strong focus on query speed and data source flexibility for both relational data and schemaless data.  It works in the web browser, Node.js, and mobile apps.
 
@@ -120,7 +122,7 @@ For the browser: include [alasql.min.js](https://cdn.jsdelivr.net/npm/alasql)
 
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/alasql@0.7"></script>
+<script src="https://cdn.jsdelivr.net/npm/alasql@1.7"></script>
 ```
 
 

package/dist/alasql-worker.js

@@ -1,7 +1,7 @@
-//! AlaSQL v0.7.0-develop-b1a58b1bundefined | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
+//! AlaSQL v1.7.3-develop-0be167bcundefined | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
 /*
 @module alasql
-@version 0.7.0-develop-b1a58b1bundefined
+@version 1.7.3-develop-0be167bcundefined
 
 AlaSQL - JavaScript SQL database
 © 2014-2016	Andrey Gershun & Mathias Rangel Wulff

package/dist/alasql-worker.min.js

@@ -1,2 +1,2 @@
-//! AlaSQL v0.7.0-develop-b1a58b1bundefined | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
+//! AlaSQL v1.7.3-develop-0be167bcundefined | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
 !function(r,e){"function"==typeof define&&define.amd?define([],e):"object"==typeof exports?module.exports=e():r.alasql=e()}(this,function(){function i(r,e,t){"function"==typeof(e=e||[])&&(scope=t,t=e,e=[]),"object"!=typeof e&&(e=[e]);var o=i.lastid++;i.buffer[o]=t,i.webworker.postMessage({id:o,sql:r,params:e})}var s;if(i.options={},i.options.progress=function(){},isArray=function(r){return"[object Array]"===Object.prototype.toString.call(r)},i.promise=function(){throw new Error("Please include a Promise/A+ library")},"undefined"!=typeof Promise&&(s=function(r,e,n,s){return new Promise(function(t,o){i(r,e,function(r,e){e?o(e):(n&&s&&!1!==i.options.progress&&i.options.progress(n,s),t(r))})})},i.promise=function(r,e){if("undefined"==typeof Promise)throw new Error("Please include a Promise/A+ library");if("string"==typeof r)return s(r,e);if(!isArray(r)||r.length<1||void 0!==e)throw new Error("Error in .promise parameters");return function(r){if(!(r.length<1)){for(var e,t,o=[],n=0;n<r.length;n++){if("string"==typeof(t=r[n])&&(t=[t]),!isArray(t)||t.length<1||2<t.length)throw new Error("Error in .promise parameter");e=t[0],t=t[1]||void 0,o.push(s(e,t,n,r.length))}return Promise.all(o)}}(r)}),!(i=i||!1))throw new Error("alasql was not found");return i.worker=function(){throw new Error("Can find webworker in this enviroment")},"undefined"!=typeof Worker&&(i.worker=function(r,e,t){if(void 0===(r=!0===r?void 0:r))for(var o=document.getElementsByTagName("script"),n=0;n<o.length;n++){if("alasql-worker.js"===o[n].src.substr(-16).toLowerCase()){r=o[n].src.substr(0,o[n].src.length-16)+"alasql.js";break}if("alasql-worker.min.js"===o[n].src.substr(-20).toLowerCase()){r=o[n].src.substr(0,o[n].src.length-20)+"alasql.min.js";break}if("alasql.js"===o[n].src.substr(-9).toLowerCase()){r=o[n].src;break}if("alasql.min.js"===o[n].src.substr(-13).toLowerCase()){r=o[n].src.substr(0,o[n].src.length-13)+"alasql.min.js";break}}if(void 0===r)throw new Error("Path to alasql.js is not specified");var s;!1!==r?(s="importScripts('",s+=r,s+="');self.onmessage = function(event) {alasql(event.data.sql,event.data.params, function(data){postMessage({id:event.data.id, data:data});});}",s=new Blob([s],{type:"text/plain"}),i.webworker=new Worker(URL.createObjectURL(s)),i.webworker.onmessage=function(r){var e=r.data.id;i.buffer[e](r.data.data),delete i.buffer[e]},i.webworker.onerror=function(r){throw r},1<arguments.length&&i("REQUIRE "+e.map(function(r){return'"'+r+'"'}).join(","),[],t)):!1===r&&delete i.webworker}),i.lastid=0,i.buffer={},i.worker(),i});

package/dist/alasql.fs.js

@@ -1,7 +1,7 @@
-//! AlaSQL v0.7.0-develop-b1a58b1bundefined | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
+//! AlaSQL v1.7.3-develop-0be167bcundefined | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
 /*
 @module alasql
-@version 0.7.0-develop-b1a58b1bundefined
+@version 1.7.3-develop-0be167bcundefined
 
 AlaSQL - JavaScript SQL database
 © 2014-2016	Andrey Gershun & Mathias Rangel Wulff
@@ -142,7 +142,7 @@ var alasql = function(sql, params, cb, scope) {
 	Current version of alasql 
  	@constant {string} 
 */
-alasql.version = '0.7.0-develop-b1a58b1bundefined';
+alasql.version = '1.7.3-develop-0be167bcundefined';
 
 /**
 	Debug flag
@@ -4328,6 +4328,12 @@ var getXLSX = function () {
 	return XLSX;
 };
 
+var jss = JSON.stringify;
+var reName = /[^a-z\d@-_]+/gi;
+var nss = (e) => e.replace(reName, '');
+var reTick = /`/g;
+var tss = (e) => e.replace(reTick, '');
+
 // set AlaSQl path
 alasql.path = alasql.utils.findAlaSQLPath();
 
@@ -6308,7 +6314,7 @@ yy.Search.prototype.toString = function () {
 
 yy.Search.prototype.toJS = function (context) {
 
-	var s = 'this.queriesfn[' + (this.queriesidx - 1) + '](this.params,null,' + context + ')';
+	var s = 'this.queriesfn[' + jss(this.queriesidx - 1) + '](this.params,null,' + jss(context) + ')';
 	// var s = '';
 	return s;
 };
@@ -6669,11 +6675,11 @@ alasql.srch.SET = function (val, args, stope, params) {
 		.map(function (st) {
 
 			if (st.method === '@') {
-				return "alasql.vars['" + st.variable + "']=" + st.expression.toJS('x', '');
+				return 'alasql.vars[' + jss(st.variable) + ']=' + st.expression.toJS('x', '');
 			} else if (st.method === '$') {
-				return "params['" + st.variable + "']=" + st.expression.toJS('x', '');
+				return 'params[' + jss(st.variable) + ']=' + st.expression.toJS('x', '');
 			} else {
-				return "x['" + st.column.columnid + "']=" + st.expression.toJS('x', '');
+				return 'x[' + jss(st.column.columnid) + ']=' + st.expression.toJS('x', '');
 			}
 		})
 		.join(';');
@@ -6760,17 +6766,26 @@ var compileSearchOrder = function (order) {
 					s += 'if(a' + dg + '==b' + dg + '){';
 				} else {
 					s +=
-						"if((a['" +
-						columnid +
-						"']||'')" +
+						'if((a[' +
+						jss(columnid) +
+						"]||'')" +
 						dg +
 						(ord.direction === 'ASC' ? '>' : '<') +
-						"(b['" +
-						columnid +
-						"']||'')" +
+						'(b[' +
+						jss(columnid) +
+						"]||'')" +
 						dg +
 						')return 1;';
-					s += "if((a['" + columnid + "']||'')" + dg + "==(b['" + columnid + "']||'')" + dg + '){';
+					s +=
+						'if((a[' +
+						jss(columnid) +
+						"]||'')" +
+						dg +
+						'==(b[' +
+						jss(columnid) +
+						"]||'')" +
+						dg +
+						'){';
 				}
 			} else {
 				dg = '.valueOf()';
@@ -7963,7 +7978,7 @@ yy.Select.prototype.compile = function (databaseid, params) {
 			// If this is INTO() function, then call it
 			// with one or two parameters
 			//
-			var qs = "return alasql.into['" + this.into.funcid.toUpperCase() + "'](";
+			var qs = 'return alasql.into[' + JSON.stringify(this.into.funcid.toUpperCase()) + '](';
 			if (this.into.args && this.into.args.length > 0) {
 				qs += this.into.args[0].toJS() + ',';
 				if (this.into.args.length > 1) {
@@ -8409,7 +8424,7 @@ yy.Select.prototype.compileFrom = function (query) {
 			ps += ');if(cb)res=cb(res,idx,query);return res';
 			source.datafn = new Function('query,params,cb,idx,alasql', ps);
 		} else if (tq instanceof yy.FuncValue) {
-			ps = "var res=alasql.from['" + tq.funcid.toUpperCase() + "'](";
+			ps = 'var res=alasql.from[' + JSON.stringify(tq.funcid.toUpperCase()) + '](';
 
 			if (tq.args && tq.args.length > 0) {
 				if (tq.args[0]) {
@@ -8672,7 +8687,7 @@ yy.Select.prototype.compileJoins = function (query) {
 			};
 			// source.data = ;
 
-			var s = "var res=alasql.from['" + jn.func.funcid.toUpperCase() + "'](";
+			var s = 'var res=alasql.from[' + JSON.stringify(jn.func.funcid.toUpperCase()) + '](';
 
 			var args = jn.func.args;
 			if (args && args.length > 0) {
@@ -10846,7 +10861,7 @@ yy.Op.prototype.toJS = function (context, tableid, defcols) {
 			if (!(!this.right.args || 0 === this.right.args.length)) {
 				var ss = this.right.args.map(ref);
 			}
-			s = '' + ljs + "['" + this.right.funcid + "'](" + ss.join(',') + ')';
+			s = '' + ljs + '[' + JSON.stringify(this.right.funcid) + '](' + ss.join(',') + ')';
 		} else {
 			s = '' + ljs + '[' + rightJS() + ']';
 		}
@@ -11385,7 +11400,7 @@ yy.AggrValue = function (params) {
 yy.AggrValue.prototype.toString = function (dontas) {
 	var s = '';
 	if (this.aggregatorid === 'REDUCE') {
-		s += this.funcid + '(';
+		s += this.funcid.replace(re_invalidFnNameChars, '') + '(';
 	} else {
 		s += this.aggregatorid + '(';
 	}
@@ -11657,13 +11672,15 @@ yy.Select.prototype.Where = function (expr) {
 yy.FuncValue = function (params) {
 	return yy.extend(this, params);
 };
+
+var re_invalidFnNameChars = /[^0-9A-Z_$]+/i;
 yy.FuncValue.prototype.toString = function (dontas) {
 	var s = '';
 
 	if (alasql.fn[this.funcid]) s += this.funcid;
 	else if (alasql.aggr[this.funcid]) s += this.funcid;
 	else if (alasql.stdlib[this.funcid.toUpperCase()] || alasql.stdfn[this.funcid.toUpperCase()])
-		s += this.funcid.toUpperCase();
+		s += this.funcid.toUpperCase().replace(re_invalidFnNameChars, '');
 
 	if (this.funcid !== 'CURRENT_TIMESTAMP') {
 		s += '(';
@@ -11819,10 +11836,13 @@ stdlib.MIN = stdlib.LEAST = function () {
 	);
 };
 
-stdlib.SUBSTRING = stdlib.SUBSTR = stdlib.MID = function (a, b, c) {
-	if (arguments.length == 2) return und(a, 'y.substr(' + b + '-1)');
-	else if (arguments.length == 3) return und(a, 'y.substr(' + b + '-1,' + c + ')');
-};
+stdlib.SUBSTRING =
+	stdlib.SUBSTR =
+	stdlib.MID =
+		function (a, b, c) {
+			if (arguments.length == 2) return und(a, 'y.substr(' + b + '-1)');
+			else if (arguments.length == 3) return und(a, 'y.substr(' + b + '-1,' + c + ')');
+		};
 
 stdfn.REGEXP_LIKE = function (a, b, c) {
 
@@ -12046,13 +12066,16 @@ alasql.aggr.VARP = function (v, s, stage) {
 	}
 };
 
-alasql.aggr.STD = alasql.aggr.STDDEV = alasql.aggr.STDEVP = function (v, s, stage) {
-	if (stage == 1 || stage == 2) {
-		return alasql.aggr.VARP(v, s, stage);
-	} else {
-		return Math.sqrt(alasql.aggr.VARP(v, s, stage));
-	}
-};
+alasql.aggr.STD =
+	alasql.aggr.STDDEV =
+	alasql.aggr.STDEVP =
+		function (v, s, stage) {
+			if (stage == 1 || stage == 2) {
+				return alasql.aggr.VARP(v, s, stage);
+			} else {
+				return Math.sqrt(alasql.aggr.VARP(v, s, stage));
+			}
+		};
 
 alasql._aggrOriginal = alasql.aggr;
 alasql.aggr = {};
@@ -12074,34 +12097,37 @@ for (var i = 0; i < 256; i++) {
 	lut[i] = (i < 16 ? '0' : '') + i.toString(16);
 }
 
-stdfn.NEWID = stdfn.UUID = stdfn.GEN_RANDOM_UUID = function () {
-	var d0 = (Math.random() * 0xffffffff) | 0;
-	var d1 = (Math.random() * 0xffffffff) | 0;
-	var d2 = (Math.random() * 0xffffffff) | 0;
-	var d3 = (Math.random() * 0xffffffff) | 0;
-	return (
-		lut[d0 & 0xff] +
-		lut[(d0 >> 8) & 0xff] +
-		lut[(d0 >> 16) & 0xff] +
-		lut[(d0 >> 24) & 0xff] +
-		'-' +
-		lut[d1 & 0xff] +
-		lut[(d1 >> 8) & 0xff] +
-		'-' +
-		lut[((d1 >> 16) & 0x0f) | 0x40] +
-		lut[(d1 >> 24) & 0xff] +
-		'-' +
-		lut[(d2 & 0x3f) | 0x80] +
-		lut[(d2 >> 8) & 0xff] +
-		'-' +
-		lut[(d2 >> 16) & 0xff] +
-		lut[(d2 >> 24) & 0xff] +
-		lut[d3 & 0xff] +
-		lut[(d3 >> 8) & 0xff] +
-		lut[(d3 >> 16) & 0xff] +
-		lut[(d3 >> 24) & 0xff]
-	);
-};
+stdfn.NEWID =
+	stdfn.UUID =
+	stdfn.GEN_RANDOM_UUID =
+		function () {
+			var d0 = (Math.random() * 0xffffffff) | 0;
+			var d1 = (Math.random() * 0xffffffff) | 0;
+			var d2 = (Math.random() * 0xffffffff) | 0;
+			var d3 = (Math.random() * 0xffffffff) | 0;
+			return (
+				lut[d0 & 0xff] +
+				lut[(d0 >> 8) & 0xff] +
+				lut[(d0 >> 16) & 0xff] +
+				lut[(d0 >> 24) & 0xff] +
+				'-' +
+				lut[d1 & 0xff] +
+				lut[(d1 >> 8) & 0xff] +
+				'-' +
+				lut[((d1 >> 16) & 0x0f) | 0x40] +
+				lut[(d1 >> 24) & 0xff] +
+				'-' +
+				lut[(d2 & 0x3f) | 0x80] +
+				lut[(d2 >> 8) & 0xff] +
+				'-' +
+				lut[(d2 >> 16) & 0xff] +
+				lut[(d2 >> 24) & 0xff] +
+				lut[d3 & 0xff] +
+				lut[(d3 >> 8) & 0xff] +
+				lut[(d3 >> 16) & 0xff] +
+				lut[(d3 >> 24) & 0xff]
+			);
+		};
 
 /*
 //
@@ -18753,6 +18779,7 @@ LS.dropDatabase = function (lsdbid, ifexists, cb) {
 
 LS.attachDatabase = function (lsdbid, databaseid, args, params, cb) {
 	var res = 1;
+	//	console.warn({lsdbid, databaseid, args, params, cb, dbs: Object.keys(alasql.databases)})
 	if (alasql.databases[databaseid]) {
 		throw new Error('Unable to attach database as "' + databaseid + '" because it already exists');
 	}
@@ -19655,7 +19682,14 @@ var saveAs =
 		FS_proto.WRITING = 1;
 		FS_proto.DONE = 2;
 
-		FS_proto.error = FS_proto.onwritestart = FS_proto.onprogress = FS_proto.onwrite = FS_proto.onabort = FS_proto.onerror = FS_proto.onwriteend = null;
+		FS_proto.error =
+			FS_proto.onwritestart =
+			FS_proto.onprogress =
+			FS_proto.onwrite =
+			FS_proto.onabort =
+			FS_proto.onerror =
+			FS_proto.onwriteend =
+				null;
 
 		return saveAs;
 	})(

package/dist/alasql.js

@@ -1,7 +1,7 @@
-//! AlaSQL v0.7.0-develop-b1a58b1bundefined | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
+//! AlaSQL v1.7.3-develop-0be167bcundefined | © 2014-2018 Andrey Gershun & Mathias Rangel Wulff | License: MIT
 /*
 @module alasql
-@version 0.7.0-develop-b1a58b1bundefined
+@version 1.7.3-develop-0be167bcundefined
 
 AlaSQL - JavaScript SQL database
 © 2014-2016	Andrey Gershun & Mathias Rangel Wulff
@@ -142,7 +142,7 @@ var alasql = function(sql, params, cb, scope) {
 	Current version of alasql 
  	@constant {string} 
 */
-alasql.version = '0.7.0-develop-b1a58b1bundefined';
+alasql.version = '1.7.3-develop-0be167bcundefined';
 
 /**
 	Debug flag
@@ -4323,6 +4323,12 @@ var getXLSX = function () {
 	return XLSX;
 };
 
+var jss = JSON.stringify;
+var reName = /[^a-z\d@-_]+/gi;
+var nss = (e) => e.replace(reName, '');
+var reTick = /`/g;
+var tss = (e) => e.replace(reTick, '');
+
 // set AlaSQl path
 alasql.path = alasql.utils.findAlaSQLPath();
 
@@ -6303,7 +6309,7 @@ yy.Search.prototype.toString = function () {
 
 yy.Search.prototype.toJS = function (context) {
 
-	var s = 'this.queriesfn[' + (this.queriesidx - 1) + '](this.params,null,' + context + ')';
+	var s = 'this.queriesfn[' + jss(this.queriesidx - 1) + '](this.params,null,' + jss(context) + ')';
 	// var s = '';
 	return s;
 };
@@ -6664,11 +6670,11 @@ alasql.srch.SET = function (val, args, stope, params) {
 		.map(function (st) {
 
 			if (st.method === '@') {
-				return "alasql.vars['" + st.variable + "']=" + st.expression.toJS('x', '');
+				return 'alasql.vars[' + jss(st.variable) + ']=' + st.expression.toJS('x', '');
 			} else if (st.method === '$') {
-				return "params['" + st.variable + "']=" + st.expression.toJS('x', '');
+				return 'params[' + jss(st.variable) + ']=' + st.expression.toJS('x', '');
 			} else {
-				return "x['" + st.column.columnid + "']=" + st.expression.toJS('x', '');
+				return 'x[' + jss(st.column.columnid) + ']=' + st.expression.toJS('x', '');
 			}
 		})
 		.join(';');
@@ -6755,17 +6761,26 @@ var compileSearchOrder = function (order) {
 					s += 'if(a' + dg + '==b' + dg + '){';
 				} else {
 					s +=
-						"if((a['" +
-						columnid +
-						"']||'')" +
+						'if((a[' +
+						jss(columnid) +
+						"]||'')" +
 						dg +
 						(ord.direction === 'ASC' ? '>' : '<') +
-						"(b['" +
-						columnid +
-						"']||'')" +
+						'(b[' +
+						jss(columnid) +
+						"]||'')" +
 						dg +
 						')return 1;';
-					s += "if((a['" + columnid + "']||'')" + dg + "==(b['" + columnid + "']||'')" + dg + '){';
+					s +=
+						'if((a[' +
+						jss(columnid) +
+						"]||'')" +
+						dg +
+						'==(b[' +
+						jss(columnid) +
+						"]||'')" +
+						dg +
+						'){';
 				}
 			} else {
 				dg = '.valueOf()';
@@ -7958,7 +7973,7 @@ yy.Select.prototype.compile = function (databaseid, params) {
 			// If this is INTO() function, then call it
 			// with one or two parameters
 			//
-			var qs = "return alasql.into['" + this.into.funcid.toUpperCase() + "'](";
+			var qs = 'return alasql.into[' + JSON.stringify(this.into.funcid.toUpperCase()) + '](';
 			if (this.into.args && this.into.args.length > 0) {
 				qs += this.into.args[0].toJS() + ',';
 				if (this.into.args.length > 1) {
@@ -8404,7 +8419,7 @@ yy.Select.prototype.compileFrom = function (query) {
 			ps += ');if(cb)res=cb(res,idx,query);return res';
 			source.datafn = new Function('query,params,cb,idx,alasql', ps);
 		} else if (tq instanceof yy.FuncValue) {
-			ps = "var res=alasql.from['" + tq.funcid.toUpperCase() + "'](";
+			ps = 'var res=alasql.from[' + JSON.stringify(tq.funcid.toUpperCase()) + '](';
 
 			if (tq.args && tq.args.length > 0) {
 				if (tq.args[0]) {
@@ -8667,7 +8682,7 @@ yy.Select.prototype.compileJoins = function (query) {
 			};
 			// source.data = ;
 
-			var s = "var res=alasql.from['" + jn.func.funcid.toUpperCase() + "'](";
+			var s = 'var res=alasql.from[' + JSON.stringify(jn.func.funcid.toUpperCase()) + '](';
 
 			var args = jn.func.args;
 			if (args && args.length > 0) {
@@ -10841,7 +10856,7 @@ yy.Op.prototype.toJS = function (context, tableid, defcols) {
 			if (!(!this.right.args || 0 === this.right.args.length)) {
 				var ss = this.right.args.map(ref);
 			}
-			s = '' + ljs + "['" + this.right.funcid + "'](" + ss.join(',') + ')';
+			s = '' + ljs + '[' + JSON.stringify(this.right.funcid) + '](' + ss.join(',') + ')';
 		} else {
 			s = '' + ljs + '[' + rightJS() + ']';
 		}
@@ -11380,7 +11395,7 @@ yy.AggrValue = function (params) {
 yy.AggrValue.prototype.toString = function (dontas) {
 	var s = '';
 	if (this.aggregatorid === 'REDUCE') {
-		s += this.funcid + '(';
+		s += this.funcid.replace(re_invalidFnNameChars, '') + '(';
 	} else {
 		s += this.aggregatorid + '(';
 	}
@@ -11652,13 +11667,15 @@ yy.Select.prototype.Where = function (expr) {
 yy.FuncValue = function (params) {
 	return yy.extend(this, params);
 };
+
+var re_invalidFnNameChars = /[^0-9A-Z_$]+/i;
 yy.FuncValue.prototype.toString = function (dontas) {
 	var s = '';
 
 	if (alasql.fn[this.funcid]) s += this.funcid;
 	else if (alasql.aggr[this.funcid]) s += this.funcid;
 	else if (alasql.stdlib[this.funcid.toUpperCase()] || alasql.stdfn[this.funcid.toUpperCase()])
-		s += this.funcid.toUpperCase();
+		s += this.funcid.toUpperCase().replace(re_invalidFnNameChars, '');
 
 	if (this.funcid !== 'CURRENT_TIMESTAMP') {
 		s += '(';
@@ -11814,10 +11831,13 @@ stdlib.MIN = stdlib.LEAST = function () {
 	);
 };
 
-stdlib.SUBSTRING = stdlib.SUBSTR = stdlib.MID = function (a, b, c) {
-	if (arguments.length == 2) return und(a, 'y.substr(' + b + '-1)');
-	else if (arguments.length == 3) return und(a, 'y.substr(' + b + '-1,' + c + ')');
-};
+stdlib.SUBSTRING =
+	stdlib.SUBSTR =
+	stdlib.MID =
+		function (a, b, c) {
+			if (arguments.length == 2) return und(a, 'y.substr(' + b + '-1)');
+			else if (arguments.length == 3) return und(a, 'y.substr(' + b + '-1,' + c + ')');
+		};
 
 stdfn.REGEXP_LIKE = function (a, b, c) {
 
@@ -12041,13 +12061,16 @@ alasql.aggr.VARP = function (v, s, stage) {
 	}
 };
 
-alasql.aggr.STD = alasql.aggr.STDDEV = alasql.aggr.STDEVP = function (v, s, stage) {
-	if (stage == 1 || stage == 2) {
-		return alasql.aggr.VARP(v, s, stage);
-	} else {
-		return Math.sqrt(alasql.aggr.VARP(v, s, stage));
-	}
-};
+alasql.aggr.STD =
+	alasql.aggr.STDDEV =
+	alasql.aggr.STDEVP =
+		function (v, s, stage) {
+			if (stage == 1 || stage == 2) {
+				return alasql.aggr.VARP(v, s, stage);
+			} else {
+				return Math.sqrt(alasql.aggr.VARP(v, s, stage));
+			}
+		};
 
 alasql._aggrOriginal = alasql.aggr;
 alasql.aggr = {};
@@ -12069,34 +12092,37 @@ for (var i = 0; i < 256; i++) {
 	lut[i] = (i < 16 ? '0' : '') + i.toString(16);
 }
 
-stdfn.NEWID = stdfn.UUID = stdfn.GEN_RANDOM_UUID = function () {
-	var d0 = (Math.random() * 0xffffffff) | 0;
-	var d1 = (Math.random() * 0xffffffff) | 0;
-	var d2 = (Math.random() * 0xffffffff) | 0;
-	var d3 = (Math.random() * 0xffffffff) | 0;
-	return (
-		lut[d0 & 0xff] +
-		lut[(d0 >> 8) & 0xff] +
-		lut[(d0 >> 16) & 0xff] +
-		lut[(d0 >> 24) & 0xff] +
-		'-' +
-		lut[d1 & 0xff] +
-		lut[(d1 >> 8) & 0xff] +
-		'-' +
-		lut[((d1 >> 16) & 0x0f) | 0x40] +
-		lut[(d1 >> 24) & 0xff] +
-		'-' +
-		lut[(d2 & 0x3f) | 0x80] +
-		lut[(d2 >> 8) & 0xff] +
-		'-' +
-		lut[(d2 >> 16) & 0xff] +
-		lut[(d2 >> 24) & 0xff] +
-		lut[d3 & 0xff] +
-		lut[(d3 >> 8) & 0xff] +
-		lut[(d3 >> 16) & 0xff] +
-		lut[(d3 >> 24) & 0xff]
-	);
-};
+stdfn.NEWID =
+	stdfn.UUID =
+	stdfn.GEN_RANDOM_UUID =
+		function () {
+			var d0 = (Math.random() * 0xffffffff) | 0;
+			var d1 = (Math.random() * 0xffffffff) | 0;
+			var d2 = (Math.random() * 0xffffffff) | 0;
+			var d3 = (Math.random() * 0xffffffff) | 0;
+			return (
+				lut[d0 & 0xff] +
+				lut[(d0 >> 8) & 0xff] +
+				lut[(d0 >> 16) & 0xff] +
+				lut[(d0 >> 24) & 0xff] +
+				'-' +
+				lut[d1 & 0xff] +
+				lut[(d1 >> 8) & 0xff] +
+				'-' +
+				lut[((d1 >> 16) & 0x0f) | 0x40] +
+				lut[(d1 >> 24) & 0xff] +
+				'-' +
+				lut[(d2 & 0x3f) | 0x80] +
+				lut[(d2 >> 8) & 0xff] +
+				'-' +
+				lut[(d2 >> 16) & 0xff] +
+				lut[(d2 >> 24) & 0xff] +
+				lut[d3 & 0xff] +
+				lut[(d3 >> 8) & 0xff] +
+				lut[(d3 >> 16) & 0xff] +
+				lut[(d3 >> 24) & 0xff]
+			);
+		};
 
 /*
 //
@@ -18748,6 +18774,7 @@ LS.dropDatabase = function (lsdbid, ifexists, cb) {
 
 LS.attachDatabase = function (lsdbid, databaseid, args, params, cb) {
 	var res = 1;
+	//	console.warn({lsdbid, databaseid, args, params, cb, dbs: Object.keys(alasql.databases)})
 	if (alasql.databases[databaseid]) {
 		throw new Error('Unable to attach database as "' + databaseid + '" because it already exists');
 	}
@@ -19650,7 +19677,14 @@ var saveAs =
 		FS_proto.WRITING = 1;
 		FS_proto.DONE = 2;
 
-		FS_proto.error = FS_proto.onwritestart = FS_proto.onprogress = FS_proto.onwrite = FS_proto.onabort = FS_proto.onerror = FS_proto.onwriteend = null;
+		FS_proto.error =
+			FS_proto.onwritestart =
+			FS_proto.onprogress =
+			FS_proto.onwrite =
+			FS_proto.onabort =
+			FS_proto.onerror =
+			FS_proto.onwriteend =
+				null;
 
 		return saveAs;
 	})(