mm_sqlite 1.0.5 → 1.0.6

package/sql.js

@@ -3,7 +3,16 @@
  * @author <a href="http://qww.elins.cn">邱文武</a>
  * @version 1.2
  */
-require('mm_expand');
+require('mm_logs');
+const SqlString = require('sqlstring');
+
+function escape(value, stringifyObjects, timeZone) {
+	return SqlString.escape(value, stringifyObjects, timeZone);
+}
+
+function escapeId(value, forbidQualified) {
+	return SqlString.escapeId(value, forbidQualified);
+}
 
 /**
  * @class 数据库语法通用类
@@ -24,6 +33,23 @@ class Sql {
 		 * 更改函数 用于增删改
 		 */
 		this.exec = exec;
+		/**
+		 * 规避SQL注入函数
+		 * @param {Object} value 值
+		 * @return {String} 返回执行结果
+		 */
+		this.escape = function(value) {
+			return escape(value);
+		};
+
+		/**
+		 * 规避排序、SQL注入函数
+		 * @param {String} key 键
+		 * @return {String} 返回执行结果
+		 */
+		this.escapeId = function(key) {
+			return escapeId(key);
+		};
 
 		/**
 		 * sql语句
@@ -65,6 +91,11 @@ class Sql {
 		 */
 		this.orderby = "";
 
+		/**
+		 * 查询分组
+		 */
+		this.groupby = "";
+
 		/**
 		 * 是否统计查询结果数
 		 */
@@ -112,6 +143,8 @@ class Sql {
 				"count_ret": "count_ret"
 			}
 		};
+
+		this.like = false;
 	}
 }
 
@@ -164,7 +197,7 @@ Sql.prototype.toQuery = function(where, sort, view) {
 		sql += " WHERE " + where;
 	}
 	if (sort) {
-		sql += " ORDER BY " + sort;
+		sql += " ORDER BY " + sort.replace(/;/, '');
 	}
 	sql = sql.replace("{0}", this.table).replace("{1}", view);
 	if (this.size && this.page) {
@@ -233,13 +266,14 @@ Sql.prototype.addOrSetSql = async function(where, set) {
 		var arr = set.split(',');
 		var key = "";
 		var value = "";
-		arr.map(function(o) {
+		for (var i = 0; i < arr.length; i++) {
+			var o = arr[i];
 			var ar = o.split('=');
 			if (ar.length === 2) {
 				key += "," + ar[0];
 				value += "," + ar[1];
 			}
-		});
+		}
 		return await this.addSql(key.replace(',', ''), value.replace(',', ''));
 	}
 	return await this.setSql(where, set);
@@ -262,6 +296,7 @@ Sql.prototype.countSql = async function(where) {
 	}
 	return n;
 };
+
 /**
  * @description 查询数据并返回符合条件总数
  * @param {String} where 查询条件
@@ -281,20 +316,182 @@ Sql.prototype.getCountSql = async function(where, sort, view) {
 	};
 	return ret;
 };
+
+/**
+ * @description 统计学
+ * @param {String} where 查询条件
+ * @param {String} groupby 分组的字段
+ * @param {String} view 返回的字段
+ * @param {String} sort 排序方式
+ * @return {Promise|Object} 查询到的内容列表和符合条件总数
+ */
+Sql.prototype.groupMathSql = async function(where, groupby, view, sort, method) {
+	if (!view) {
+		view = "*"
+	}
+	var viewStr = "";
+	if (view.indexOf(",") !== -1) {
+		var arr = view.split(",");
+		for (var i = 0; i < arr.length; i++) {
+			var str = this.escapeId(arr[i]);
+			viewStr += "," + method.toUpperCase() + "(" + str + ") " + method.toLowerCase() + "_" + str.replace(
+				/`/g, "")
+		}
+	} else {
+		viewStr = "," + method.toUpperCase() + "(" + this.escapeId(view) + ") " + method.toLowerCase() + "_" +
+			view.replace(/`/g, "")
+	}
+	var sql = "SELECT " + (groupby ? this.escapeId(groupby) : "") + viewStr + " FROM `" + this.table + "`";
+	if (where) {
+		sql += ' WHERE ' + where;
+	}
+	if (groupby) {
+		sql += " GROUP BY " + this.escapeId(groupby);
+	}
+	if (sort) {
+		sql += " ORDER BY " + sort;
+	}
+	if (this.size && this.page) {
+		var start = this.size * (this.page - 1);
+		sql += " limit " + start + ',' + this.size;
+	}
+	return await this.run(sql);
+}
+
+
+/**
+ * @description 分组求平均值
+ * @param {String} where 查询条件
+ * @param {String} groupby 分组的字段
+ * @param {String} view 返回的字段
+ * @param {String} sort 排序方式
+ * @return {Promise|Object} 查询到的内容列表和符合条件总数
+ */
+Sql.prototype.groupAvgSql = async function(where, groupby, view, sort = "") {
+	return await this.groupMathSql(where, groupby, view, sort, "AVG");
+};
+
+/**
+ * @description 分组合计数值
+ * @param {String} where 查询条件
+ * @param {String} groupby 分组的字段
+ * @param {String} view 返回的字段
+ * @param {String} sort 排序方式
+ * @return {Promise|Object} 查询到的内容列表和符合条件总数
+ */
+Sql.prototype.groupSumSql = async function(where, groupby, view, sort = "") {
+	return await this.groupMathSql(where, groupby, view, sort, "SUM");
+};
+
+/**
+ * @description 分组合计不同条数
+ * @param {String} where 查询条件
+ * @param {String} groupby 分组的字段
+ * @param {String} view 返回的字段
+ * @return {Promise|Object} 查询到的内容列表和符合条件总数
+ */
+Sql.prototype.groupCountSql = async function(where, groupby, view, sort = "") {
+	return await this.groupMathSql(where, groupby, view, sort, "COUNT");
+};
+
+
+/**
+ * @description 统计学
+ * @param {Object} query 查询条件
+ * @param {String} groupby 分组的字段
+ * @param {String} view 返回的字段
+ * @param {String} sort 排序方式
+ * @return {Promise|Object} 查询到的内容列表和符合条件总数
+ */
+Sql.prototype.groupMath = async function(query, groupby, view, sort, method) {
+	var where = this.toWhere(query, this.like);
+	return await this.groupMathSql(where, groupby, view, sort, method);
+};
+
+/**
+ * @description 分组求平均值
+ * @param {Object} query 查询条件
+ * @param {String} groupby 分组的字段
+ * @param {String} view 返回的字段
+ * @param {String} sort 排序方式
+ * @return {Promise|Object} 查询到的内容列表和符合条件总数
+ */
+Sql.prototype.groupAvg = async function(query, groupby, view, sort) {
+	return await this.groupMath(query, groupby, view, sort, "AVG");
+};
+
+/**
+ * @description 分组合计数值
+ * @param {Object} query 查询条件
+ * @param {String} groupby 分组的字段
+ * @param {String} view 返回的字段
+ * @param {String} sort 排序方式
+ * @return {Promise|Object} 查询到的内容列表和符合条件总数
+ */
+Sql.prototype.groupSum = async function(query, groupby, view, sort) {
+	return await this.groupMath(query, groupby, view, sort, "SUM");
+};
+
+/**
+ * @description 分组合计不同条数
+ * @param {Object} query 查询条件
+ * @param {String} groupby 分组的字段
+ * @param {String} view 返回的字段
+ * @return {Promise|Object} 查询到的内容列表和符合条件总数
+ */
+Sql.prototype.groupCount = async function(query, groupby, view, sort) {
+	return await this.groupMath(query, groupby, view, sort, "COUNT");
+};
+
 /* ===  sql语句拼接函数  === */
-/// 
 /**
  * @description 转为where语句
  * @param {Object} obj 用作拼接的对象
+ * @param {Boolean} like 是否使用like匹配, 默认不使用
  * @return {String} where格式sql语句字符串
  */
-Sql.prototype.toWhere = function(obj) {
+Sql.prototype.toWhere = function(obj, like) {
 	var where = "";
-	for (var k in obj) {
-		where += " and `" + k + "`='" + obj[k] + "'";
+	if (like === undefined) {
+		like = this.like;
+	}
+	if (like) {
+		for (var k in obj) {
+			var val = obj[k];
+			if (k.endWith('_min')) {
+				where += " and " + this.escapeId(k.replace('_min', '')) + " >= " + this.escape(val);
+			} else if (k.endWith('_max')) {
+				where += " and " + this.escapeId(k.replace('_max', '')) + " <= " + this.escape(val);
+			} else if (k.endWith('_not')) {
+				where += " and " + this.escapeId(k.replace('_not', '')) + " != " + this.escape(val);
+			} else if (k.endWith('_has')) {
+				where += " and " + this.escapeId(k.replace('_has', '')) + " in (" + val + ")";
+			} else if (typeof(val) === "string" && !/^[0-9]+$/.test(val)) {
+				where += " and " + this.escapeId(k) + " LIKE '%" + this.escape(val).trim("'") + "%'"
+			} else {
+				where += " and " + this.escapeId(k) + " = " + val
+			}
+		}
+	} else {
+		for (var k in obj) {
+			var val = obj[k];
+			if (k.endWith('_min')) {
+				where += " and " + this.escapeId(k.replace('_min', '')) + " >= " + this.escape(val.replace('_min',
+					''));
+			} else if (k.endWith('_max')) {
+				where += " and " + this.escapeId(k.replace('_max', '')) + " <= " + this.escape(val);
+			} else if (k.endWith('_not')) {
+				where += " and " + this.escapeId(k.replace('_not', '')) + " != " + this.escape(val);
+			} else if (k.endWith('_has')) {
+				where += " and " + this.escapeId(k.replace('_has', '')) + " in (" + val.replace(/`/gi, "") + ")";
+			} else {
+				where += " and " + this.escapeId(k) + "=" + this.escape(val);
+			}
+		}
 	}
 	return where.replace(" and ", "");
 };
+
 /**
  * @description 转为set语句
  * @param {Object} obj 用作拼接的对象
@@ -303,7 +500,16 @@ Sql.prototype.toWhere = function(obj) {
 Sql.prototype.toSet = function(obj) {
 	var set = "";
 	for (var k in obj) {
-		set += ",`" + k + "`='" + obj[k] + "'";
+		var val = this.escape(obj[k]);
+		if (k.endWith('_add')) {
+			var k2 = this.escapeId(k.replace('_add', ''));
+			set += "," + k2 + " = " + k2 + " + " + val;
+		} else if (k.endWith('_del')) {
+			var k3 = this.escapeId(k.replace('_del', ''));
+			set += "," + k3 + " = " + k3 + " - " + val;
+		} else {
+			set += "," + this.escapeId(k) + " = " + val;
+		}
 	}
 	return set.replace(",", "");
 };
@@ -317,8 +523,8 @@ Sql.prototype.toAddSql = function(item) {
 	var key = "";
 	var val = "";
 	for (var k in item) {
-		key += ",`" + k + "`";
-		val += ",'" + item[k] + "'";
+		key += "," + this.escapeId(k);
+		val += "," + this.escape(item[k]);
 	}
 	var sql = "INSERT INTO `{0}` ({1}) VALUES ({2});";
 	return sql.replace("{0}", this.table).replace("{1}", key.replace(",", "")).replace("{2}", val.replace(",", ""));
@@ -353,10 +559,11 @@ Sql.prototype.toSetSql = function(query, item) {
  * @param {Object} query 查询键值集合
  * @param {String} sort 排序规则
  * @param {String} view 显示的字段
+ * @param {Boolean} like 是否使用like匹配, 默认使用
  * @return {String} sql语句
  */
-Sql.prototype.toGetSql = function(query, sort, view) {
-	var where = this.toWhere(query);
+Sql.prototype.toGetSql = function(query, sort, view, like = true) {
+	var where = this.toWhere(query, like);
 	var sql = this.toQuery(where, sort, view);
 	return sql;
 };
@@ -396,10 +603,11 @@ Sql.prototype.set = function(query, item) {
  * @param {Object} query 查询条件
  * @param {String} sort 排序
  * @param {String} view 返回的字段
+ * @param {Boolean} like 是否使用like匹配, 默认使用
  * @return {Promise|Array} 查询结果
  */
-Sql.prototype.get = function(query, sort, view) {
-	var sql = this.toGetSql(query, sort, view);
+Sql.prototype.get = function(query, sort, view, like = true) {
+	var sql = this.toGetSql(query, sort, view, like);
 	return this.run(sql);
 };
 
@@ -407,19 +615,21 @@ Sql.prototype.get = function(query, sort, view) {
  * @description 添加或修改
  * @param {Object} where 查询条件集合
  * @param {Object} set 修改的键值
+ * @param {Boolean} like 是否使用like匹配, 默认不使用
  * @return {Promise|Object} 执行结果
  */
-Sql.prototype.addOrSet = async function(where, set) {
-	return await this.addOrSetSql(this.toWhere(where), this.toSet(set));
+Sql.prototype.addOrSet = async function(where, set, like) {
+	return await this.addOrSetSql(this.toWhere(where, like), this.toSet(set));
 };
 
 /**
  * @description 查询符合结果总数
  * @param {Object} query 查询条件集合
+ * @param {Boolean} like 是否使用like匹配, 默认使用
  * @return {Promise|Number} 查询结果
  */
-Sql.prototype.count = function(query) {
-	return this.countSql(this.toWhere(query));
+Sql.prototype.count = function(query, like = true) {
+	return this.countSql(this.toWhere(query, like));
 };
 
 /**
@@ -427,24 +637,27 @@ Sql.prototype.count = function(query) {
  * @param {Object} query 查询条件
  * @param {String} sort 排序
  * @param {String} view 返回的字段
+ * @param {Boolean} like 是否使用like匹配, 默认使用
  * @return {Promise|Object} 查询到的内容列表和符合条件总数
  */
-Sql.prototype.getCount = async function(query, sort, view) {
-	return this.getCountSql(this.toWhere(query), sort, view);
+Sql.prototype.getCount = async function(query, sort, view, like = true) {
+	return this.getCountSql(this.toWhere(query, like), sort, view);
 };
 
 /* ===  传入数组操作  === */
 /**
  * @description 添加多条数据
  * @param {Array} list 对象数组
+ * @param {Boolean} lock 是否锁定
  * @return {Promise|Object} 执行结果
  */
-Sql.prototype.addList = function(list) {
-	var sql = "START TRANSACTION;\n";
+Sql.prototype.addList = function(list, lock = true) {
+	var sql = lock ? "BEGIN;\r\n" : "\r\n";
 	var len = list.length;
 	for (var i = 0; i < len; i++) {
-		sql += this.toAddSql(list[i]);
+		sql += this.toAddSql(list[i]) + "\r\n";
 	}
+	sql += lock ? "COMMIT;" : "";
 	return this.exec(sql);
 };
 /**
@@ -484,7 +697,8 @@ Sql.prototype.setList = function(list) {
 Sql.prototype.has_param = function(paramDt, sqlDt) {
 	var bl = false;
 	for (var key in sqlDt) {
-		if (paramDt[key] !== undefined && paramDt[key] !== null && paramDt[key] !== '') {
+		var value = paramDt[key];
+		if (value !== undefined && value !== null && value !== '') {
 			bl = true;
 			break;
 		}
@@ -533,7 +747,7 @@ Sql.prototype.filter_param = function(paramDt, sqlDt) {
  */
 Sql.prototype.tpl_query = function(paramDt, sqlDt) {
 	var sql = "";
-	if(sqlDt){
+	if (sqlDt) {
 		var l = this.config.separator;
 		if (l) {
 			for (var key in paramDt) {
@@ -546,12 +760,12 @@ Sql.prototype.tpl_query = function(paramDt, sqlDt) {
 						var sl = "(";
 						var len = arr.length;
 						for (var i = 0; i < len; i++) {
-							sl += " || " + tpl.replaceAll("{0}", arr[i]);
+							sl += " || " + tpl.replaceAll("{0}", this.escape(arr[i]).trim("'"));
 						}
 						sl = sl.replace(" || ", "") + ")";
 						sql += " && " + sl;
 					} else {
-						sql += " && " + tpl.replaceAll("{0}", value);
+						sql += " && " + tpl.replaceAll("{0}", this.escape(value).trim("'"));
 					}
 				} else {
 					if (arr.length > 1) {
@@ -559,49 +773,50 @@ Sql.prototype.tpl_query = function(paramDt, sqlDt) {
 						var sl = "(";
 						var len = arr.length;
 						for (var i = 0; i < len; i++) {
-							sl += " || `" + key + "` = '" + arr[i] + "'";
+							sl += " || " + this.escapeId(key) + " = " + this.escape(arr[i]);
 						}
 						sl = sl.replace(" || ", "") + ")";
 						sql += " && " + sl;
 					} else {
-						sql += " && `" + key + "` = '" + value + "'";
+						sql += " && " + this.escapeId(key) + " = " + this.escape(value);
 					}
 				}
 			}
 		} else {
 			for (var key in paramDt) {
+				var value = this.escape(paramDt[key]);
 				if (sqlDt[key]) {
-					sql += " && " + sqlDt[key].replaceAll("{0}", paramDt[key]);
+					sql += " && " + sqlDt[key].replaceAll("{0}", value.trim("'"));
 				} else {
-					sql += " && `" + key + "` = '" + paramDt[key] + "'";
+					sql += " && " + this.escapeId(key) + " = " + value;
 				}
 			}
 		}
-	}
-	else {
+	} else {
 		// 如果没有模板，则直接拼接参数
 		var l = this.config.separator;
 		if (l) {
 			// 使用分隔数组拼接
 			for (var key in paramDt) {
-				var arr = paramDt[key].split(l);
+				var value = paramDt[key];
+				var arr = value.split(l);
 				if (arr.length > 1) {
 					// 如果数量大于0，则增加多条件
 					var sl = "(";
 					var len = arr.length;
 					for (var i = 0; i < len; i++) {
-						sl += " || `" + key + "` = '" + arr[i] + "'";
+						sl += " || " + this.escapeId(key) + " = " + this.escape(arr[i]);
 					}
 					sl = sl.replace(" || ", "") + ")";
 					sql += " && " + sl;
 				} else {
-					sql += " && `" + key + "` = '" + paramDt[key] + "'";
+					sql += " && " + this.escapeId(key) + " = " + this.escape(value);
 				}
 			}
 		} else {
 			// 直接拼接
 			for (var key in paramDt) {
-				sql += " && `" + key + "` = '" + paramDt[key] + "'";
+				sql += " && " + this.escapeId(key) + " = " + this.escape(paramDt[key]);
 			}
 		}
 	}
@@ -618,14 +833,15 @@ Sql.prototype.tpl_body = function(paramDt, sqlDt) {
 	var sql = "";
 	if (!sqlDt || sqlDt.length === 0) {
 		for (var key in paramDt) {
-			sql += " , `" + key + "` = '" + val[key];
+			sql += " , " + this.escapeId(key) + " = " + this.escape(val[key]);
 		}
 	} else {
 		for (var key in paramDt) {
+			var value = this.escape(paramDt[key]);
 			if (sqlDt[key]) {
-				sql += " , " + sqlDt[key].replace("{0}", paramDt[key]).replace('+ -', '- ').replace('- -', '+ ');
+				sql += " , " + sqlDt[key].replace("{0}", value).replace('+ -', '- ').replace('- -', '+ ');
 			} else {
-				sql += " , `" + key + "` = '" + paramDt[key] + "'";
+				sql += " , " + this.escapeId(key) + " = " + value;
 			}
 		}
 	}
@@ -645,11 +861,14 @@ Sql.prototype.model = function(model) {
 				var n = obj[prop];
 				var cha = value - n;
 				if (cha > 0) {
-					_this.setSql("`" + _this.key + "`=" + obj[_this.key] + "", "`" + prop + "`=`" + prop + "` + " + cha);
+					_this.setSql("`" + _this.key + "`=" + obj[_this.key], "`" + prop + "`=`" +
+						prop + "` + " + cha);
 				} else if (cha < 0) {
-					_this.setSql("`" + _this.key + "`=" + obj[_this.key] + "", "`" + prop + "`=`" + prop + "` - " + (-cha));
+					_this.setSql("`" + _this.key + "`=" + obj[_this.key], "`" + prop + "`=`" +
+						prop + "` - " + (-cha));
 				} else {
-					_this.setSql("`" + _this.key + "`=" + obj[_this.key] + "", "`" + prop + "`=" + value);
+					_this.setSql("`" + _this.key + "`=" + obj[_this.key], "`" + prop + "`=" +
+						value);
 				}
 			} else {
 				var query = {};
@@ -669,21 +888,26 @@ Sql.prototype.model = function(model) {
  * @param {Object} query 查询条件
  * @param {String} sort 排序
  * @param {String} view 返回的字段
+ * @param {Boolean} like 是否like匹配
  * @return {Promise|Array} 查询结果
  */
-Sql.prototype.getObj = async function(query, sort, view) {
+Sql.prototype.getObj = async function(query, sort, view, like) {
 	this.page = 1;
 	this.size = 1;
-	if (this.key) {
-		if (view && view.indexOf(this.key) === -1 && view.indexOf('*') === -1) {
-			view += ",`" + this.key + "`";
+	var key = this.key;
+	if (key) {
+		if (view && view.indexOf(key) === -1 && view.indexOf('*') === -1) {
+			view += "," + this.escapeId(key);
 		}
 	}
-	var sql = this.toGetSql(query, sort, view);
+	if (like === undefined) {
+		like = this.like;
+	}
+	var sql = this.toGetSql(query, sort, view, like);
 	var list = await this.run(sql);
 	if (list.length > 0) {
 		var obj = list[0];
-		if (this.key) {
+		if (key) {
 			return this.model(obj);
 		} else {
 			return obj;
@@ -693,4 +917,4 @@ Sql.prototype.getObj = async function(query, sort, view) {
 	}
 };
 
-module.exports = Sql;
+module.exports = Sql;

package/sql.json

@@ -0,0 +1,56 @@
+{
+    "name": "user_account",
+    "title": "用户信息",
+    "table": "user_account",
+    "key": "user_id",
+    "orderby_default": "`user_id` desc",
+    "field_default": "`user_id`,`state`,`vip`,`gm`,`mc`,`referee_id`,`create_time`,`login_time`,`invite_code`,`phone`,`phone_state`,`username`,`nickname`,`email`,`email_state`,`user_group`,`user_admin`,`login_ip`,`signature`,`avatar`,`friends`,`admin_group`",
+    "method": "get",
+    "query": {
+        "state_min": "`state` >= '{0}'",
+        "state_max": "`state` <= '{0}'",
+        "vip_min": "`vip` >= '{0}'",
+        "vip_max": "`vip` <= '{0}'",
+        "gm_min": "`gm` >= '{0}'",
+        "gm_max": "`gm` <= '{0}'",
+        "mc_min": "`mc` >= '{0}'",
+        "mc_max": "`mc` <= '{0}'",
+        "create_time_min": "`create_time` >= '{0}'",
+        "create_time_max": "`create_time` <= '{0}'",
+        "login_time_min": "`login_time` >= '{0}'",
+        "login_time_max": "`login_time` <= '{0}'",
+        "salt": "`salt` like '%{0}%'",
+        "invite_code": "`invite_code` like '%{0}%'",
+        "phone": "`phone` like '%{0}%'",
+        "username": "`username` like '%{0}%'",
+        "nickname": "`nickname` like '%{0}%'",
+        "password": "`password` like '%{0}%'",
+        "email": "`email` like '%{0}%'",
+        "user_group": "`user_group` like '%{0}%'",
+        "user_admin": "`user_admin` like '%{0}%'",
+        "login_ip": "`login_ip` like '%{0}%'",
+        "signature": "`signature` like '%{0}%'",
+        "avatar": "`avatar` like '%{0}%'",
+        "friends": "`friends` like '%{0}%'",
+        "admin_group": "`admin_group` like '%{0}%'"
+    },
+    "query_default": {
+        "user_id": "`user_id` = {user_id}"
+    },
+    "update": {
+        "state_add": "`state` = `state` + '{0}'",
+        "vip_add": "`vip` = `vip` + '{0}'",
+        "gm_add": "`gm` = `gm` + '{0}'",
+        "mc_add": "`mc` = `mc` + '{0}'"
+    },
+    "filter": {
+        "table": "table",
+        "page": "page",
+        "size": "size",
+        "method": "method",
+        "orderby": "orderby",
+        "field": "field",
+        "count_ret": "count_ret",
+        "user_id": "user_id"
+    }
+}