ghostbase-cli 0.1.2__tar.gz → 0.1.4__tar.gz

{ghostbase_cli-0.1.2 → ghostbase_cli-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ghostbase-cli
-Version: 0.1.2
+Version: 0.1.4
 Summary: A fast, keyboard-driven terminal database studio for SQLite, PostgreSQL & MySQL
 Author-email: 4yk5 <contact.4yk5@proton.me>
 License-Expression: MIT

{ghostbase_cli-0.1.2 → ghostbase_cli-0.1.4}/app.py

@@ -342,7 +342,7 @@ class GhostBaseApp(App):
             yield Label(f"[{self.db.db_type_label()}]", id="db-type-label")
             yield Label(db_label, id="db-name-label")
             yield Label(safe_text, id="safe-badge", classes=safe_class)
-            yield Label("v0.1.2", id="version-label")
+            yield Label("v0.1.4", id="version-label")
 
         with Horizontal(id="main-container"):
             with Vertical(id="sidebar"):
@@ -389,9 +389,14 @@ class GhostBaseApp(App):
     # Lifecycle
 
     async def on_mount(self):
-        # Configure database engine level Read-Only mode if safe_mode is enabled
+        # Configure database engine level Read-Only mode if safe_mode is enabled (strictly fail-closed)
         if self.safe_mode:
-            self.db.set_read_only(True)
+            try:
+                self.db.set_read_only(True)
+            except Exception as e:
+                self.notify(f"Security Alert: Failed to enforce Read-Only mode on database: {e}", severity="error")
+                self.exit(return_code=1)
+                return
 
         tables = self.db.get_tables()
         # Only populate demo tables when explicitly requested, in-memory, or default sample.db AND NOT in safe_mode
@@ -810,13 +815,18 @@ class GhostBaseApp(App):
         self.notify("Execution Plan analyzed successfully")
 
     def action_toggle_safe_mode(self):
-        """Toggle Production Safe Mode (Ctrl+S)"""
-        self.safe_mode = not self.safe_mode
+        """Toggle Production Safe Mode (Ctrl+S) - Fail-closed"""
+        new_mode = not self.safe_mode
         self._pending_destructive_query = None
         self._pending_destructive_time = 0.0
 
-        # Enforce/revoke database session level Read-Only
-        self.db.set_read_only(self.safe_mode)
+        # Enforce/revoke database session level Read-Only (Fail-closed)
+        try:
+            self.db.set_read_only(new_mode)
+            self.safe_mode = new_mode
+        except Exception as e:
+            self.notify(f"Cannot enable Safe Mode: {e}", severity="error", timeout=5)
+            return
 
         badge = self.query_one("#safe-badge", Label)
         if self.safe_mode:
@@ -905,7 +915,7 @@ class GhostBaseApp(App):
             else os.getcwd()
         )
         out = os.path.join(db_dir, "ghostbase_export.sql")
-        Exporter.to_sql_inserts(table_name, self.last_columns, self.last_rows, out)
+        Exporter.to_sql_inserts(table_name, self.last_columns, self.last_rows, out, dialect=self.db.db_type)
         self.notify(f"Saved: {out}", timeout=5)
 
     # Status bar

{ghostbase_cli-0.1.2 → ghostbase_cli-0.1.4}/db_engine.py

@@ -52,7 +52,7 @@ class DatabaseEngine:
                 "Run:  pip install psycopg2-binary"
             )
         self.conn = psycopg2.connect(url)
-        # Enable autocommit so transactions are not left IDLE and RETURNING queries commit immediately
+        # Enable autocommit so write transactions are not left IDLE and RETURNING queries commit immediately
         self.conn.autocommit = True
 
     def _connect_mysql(self, url: str):
@@ -65,20 +65,24 @@ class DatabaseEngine:
                 "Run:  pip install pymysql"
             )
         parsed = urllib.parse.urlparse(url)
+        # Use SSDictCursor (Server-Side streaming cursor) to protect client memory on massive queries
         self.conn = pymysql.connect(
             host=parsed.hostname or "localhost",
             port=parsed.port or 3306,
             user=parsed.username or "root",
             password=parsed.password or "",
             database=parsed.path.lstrip("/"),
-            cursorclass=pymysql.cursors.DictCursor,
+            cursorclass=pymysql.cursors.SSDictCursor,
             autocommit=True,
         )
 
-    def set_read_only(self, enabled: bool):
-        """Configure database engine session-level Read-Only mode."""
+    def set_read_only(self, enabled: bool) -> bool:
+        """
+        Configure database engine session-level Read-Only mode.
+        Returns True if successful. Raises RuntimeError if enabling fails (fail-closed).
+        """
         if not self.conn:
-            return
+            return False
         try:
             cur = self.conn.cursor()
             if self.db_type == "sqlite":
@@ -90,8 +94,11 @@ class DatabaseEngine:
             elif self.db_type == "mysql":
                 mode = "READ ONLY" if enabled else "READ WRITE"
                 cur.execute(f"SET SESSION TRANSACTION {mode};")
-        except Exception:
-            pass
+            return True
+        except Exception as e:
+            if enabled:
+                raise RuntimeError(f"Database engine failed to activate Read-Only mode: {e}")
+            return False
 
     def quote_table_name(self, table_name: str) -> str:
         """Properly quote table identifier for queries based on database engine."""
@@ -103,6 +110,9 @@ class DatabaseEngine:
                 return f'"{s}"."{t}"'
             return f'"{table_name}"'
         elif self.db_type == "mysql":
+            if "." in table_name:
+                s, t = table_name.split(".", 1)
+                return f"`{s}`.`{t}`"
             return f"`{table_name}`"
         else:  # sqlite
             return f"[{table_name}]"
@@ -347,10 +357,12 @@ class DatabaseEngine:
     def _mask_strings_and_literals(sql: str) -> Tuple[str, List[str]]:
         """
         Extract and mask all string literals and quoted identifiers:
-        - PostgreSQL dollar-quoted strings ($$ ... $$ or $tag$ ... $tag$)
-        - Standard single-quoted strings ('...')
-        - Standard double-quoted strings / identifiers ("...")
-        - MySQL backtick identifiers (`...`)
+        - Plain untagged dollar-quotes: $$...$$
+        - Tagged dollar-quotes with strict matching backreference \2: $tag$...$tag$
+        - PostgreSQL E-strings: E'...' (supporting backslash escapes \')
+        - Standard single-quoted strings: '...' (supporting \' and '')
+        - Standard double-quoted strings / identifiers: "..."
+        - MySQL backtick identifiers: `...`
         """
         literals = []
         def _repl(m):
@@ -358,7 +370,7 @@ class DatabaseEngine:
             literals.append(m.group(0))
             return f" ___GB_LIT_{idx}___ "
 
-        pattern = r"(\$(?:[a-zA-Z_]\w*)?\$[\s\S]*?\$(?:[a-zA-Z_]\w*)?\$|'(?:''|[^'])*'|\"(?:\"\"|[^\"])*\"|`(?:``|[^`])*`)"
+        pattern = r"(\$\$[\s\S]*?\$\$|\$([a-zA-Z_]\w*)\$[\s\S]*?\$\2\$|E'(?:\\.|''|[^'\\])*'|'(?:\\.|''|[^'\\])*'|\"(?:\\.|\"\"|[^\"])*\"|`(?:``|[^`])*`)"
         masked = re.sub(pattern, _repl, sql)
         return masked, literals
 
@@ -366,16 +378,17 @@ class DatabaseEngine:
         """
         Check query safety.
         - Strings and dollar-quotes are masked FIRST so inner text ('WHERE ...') does not bypass checks.
-        - Comments (-- and /* */) are stripped second.
-        - In Safe Mode: Enforces strict Read-Only operations.
+        - Comments (-- , /* */, and MySQL #) are stripped second.
+        - In Safe Mode: Enforces strict Read-Only operations, blocking all DML, DDL, DO blocks, CALL, MERGE, SET, and state-modifying functions.
         - In Normal Mode: Intercepts unconstrained destructive queries.
         """
         # 1. Mask all string literals and dollar-quoted strings FIRST
         masked, _ = self._mask_strings_and_literals(query)
 
-        # 2. Strip block comments /* ... */ and line comments -- ...
+        # 2. Strip block comments /* ... */, line comments -- ..., and MySQL # ...
         q_no_comments = re.sub(r"/\*[\s\S]*?\*/", " ", masked)
         q_no_comments = re.sub(r"--[^\r\n]*", " ", q_no_comments)
+        q_no_comments = re.sub(r"#[^\r\n]*", " ", q_no_comments)
 
         q_clean = q_no_comments.strip()
         if not q_clean:
@@ -397,13 +410,27 @@ class DatabaseEngine:
                 (r"\bGRANT\b", "GRANT statement"),
                 (r"\bREVOKE\b", "REVOKE statement"),
                 (r"\bVACUUM\b", "VACUUM statement"),
+                (r"\bSET\b", "SET configuration change"),
+                (r"\bRESET\b", "RESET configuration change"),
+                (r"\bDO\b", "DO procedural block"),
+                (r"\bCALL\b", "CALL stored procedure"),
+                (r"\bMERGE\b", "MERGE statement"),
+                (r"\bSET_CONFIG\s*\(", "SET_CONFIG parameter modification"),
+                (r"\bSETVAL\s*\(", "SETVAL sequence mutation"),
                 (r"\bNEXTVAL\s*\(", "NEXTVAL sequence advance"),
+                (r"\bCURRVAL\s*\(", "CURRVAL sequence check"),
+                (r"\bLASTVAL\s*\(", "LASTVAL sequence check"),
+                (r"\bPG_TERMINATE_BACKEND\b", "PG_TERMINATE_BACKEND admin call"),
+                (r"\bPG_CANCEL_BACKEND\b", "PG_CANCEL_BACKEND admin call"),
+                (r"\bLO_IMPORT\b", "LO_IMPORT filesystem read"),
+                (r"\bLO_EXPORT\b", "LO_EXPORT filesystem write"),
+                (r"\bDBLINK\b", "DBLINK external query execution"),
                 (r"\bINTO\s+OUTFILE\b", "INTO OUTFILE export"),
                 (r"\bINTO\s+DUMPFILE\b", "INTO DUMPFILE export"),
             ]
             for pattern, desc in write_keywords:
                 if re.search(pattern, q_upper):
-                    return True, f"Safe Mode is active: write operations ({desc}) are strictly blocked"
+                    return True, f"Safe Mode is active: write or state-altering operations ({desc}) are strictly blocked"
 
             if re.search(r"\bPRAGMA\b\s+\w+\s*=", q_upper):
                 return True, "Safe Mode is active: PRAGMA configuration writes are blocked"
@@ -427,7 +454,8 @@ class DatabaseEngine:
     def explain_query(self, query: str) -> Dict[str, Any]:
         masked, literals = self._mask_strings_and_literals(query)
         clean_q = re.sub(r"/\*[\s\S]*?\*/", " ", masked)
-        clean_q = re.sub(r"--[^\r\n]*", " ", clean_q).strip().rstrip(";")
+        clean_q = re.sub(r"--[^\r\n]*", " ", clean_q)
+        clean_q = re.sub(r"#[^\r\n]*", " ", clean_q).strip().rstrip(";")
         for idx, orig in enumerate(literals):
             clean_q = clean_q.replace(f"___GB_LIT_{idx}___", orig)
 
@@ -453,7 +481,7 @@ class DatabaseEngine:
         sql_lines = []
         for line in lines:
             stripped = line.strip()
-            if stripped.startswith("--"):
+            if stripped.startswith(("--", "#")):
                 comment_lines.append(stripped)
             else:
                 sql_lines.append(line)
@@ -504,17 +532,63 @@ class DatabaseEngine:
 
     def execute_query(self, query: str, max_rows: int = 1000) -> Dict[str, Any]:
         start = time.perf_counter()
+        cur = None
         try:
             # Check if query is DML/DDL write operation (even if it has RETURNING)
             masked, _ = self._mask_strings_and_literals(query)
             clean_q = re.sub(r"/\*[\s\S]*?\*/", " ", masked)
-            clean_q = re.sub(r"--[^\r\n]*", " ", clean_q).strip().upper()
+            clean_q = re.sub(r"--[^\r\n]*", " ", clean_q)
+            clean_q = re.sub(r"#[^\r\n]*", " ", clean_q).strip().upper()
             is_write_dml = bool(
-                re.search(r"\b(INSERT\s+INTO|UPDATE\s+|DELETE\s+FROM|DELETE\s+|REPLACE\s+INTO|CREATE\s+|DROP\s+|ALTER\s+|TRUNCATE\s+)\b", clean_q)
+                re.search(r"\b(INSERT\s+INTO|UPDATE\s+|DELETE\s+FROM|DELETE\s+|REPLACE\s+INTO|CREATE\s+|DROP\s+|ALTER\s+|TRUNCATE\s+|DO\s+|CALL\s+|MERGE\s+)\b", clean_q)
             )
 
+            # PostgreSQL streaming: Use server-side named cursor to prevent pulling entire table into client RAM
+            if self.db_type == "postgresql" and not is_write_dml:
+                stream_name = f"gb_stream_{int(time.perf_counter() * 1000000)}"
+                # Disable autocommit temporarily for named cursor creation in psycopg2
+                self.conn.autocommit = False
+                try:
+                    cur = self.conn.cursor(name=stream_name)
+                    cur.itersize = max_rows + 1
+                    cur.execute(query)
+                    if cur.description:
+                        columns = [d[0] for d in cur.description]
+                        raw = cur.fetchmany(max_rows + 1)
+                        truncated = len(raw) > max_rows
+                        display_rows = raw[:max_rows]
+                        rows = [list(r.values()) if isinstance(r, dict) else list(r) for r in display_rows]
+                        cur.close()
+                        self.conn.commit()  # Cleanly close read transaction without leaving idle connection
+                        elapsed_ms = (time.perf_counter() - start) * 1000
+                        return {
+                            "success": True,
+                            "columns": columns,
+                            "rows": rows,
+                            "row_count": len(rows),
+                            "affected_rows": 0,
+                            "truncated": truncated,
+                            "elapsed_ms": round(elapsed_ms, 2),
+                            "is_select": True,
+                            "is_returning": False,
+                        }
+                except Exception as e:
+                    try:
+                        self.conn.rollback()
+                    except Exception:
+                        pass
+                    raise e
+                finally:
+                    self.conn.autocommit = True
+
+            # MySQL optimization: Auto-apply LIMIT on SELECTs without LIMIT to prevent server unbuffered socket drain
+            exec_query = query
+            if self.db_type == "mysql" and not is_write_dml:
+                if not re.search(r"\bLIMIT\b", clean_q, flags=re.IGNORECASE):
+                    exec_query = query.rstrip().rstrip(";") + f" LIMIT {max_rows + 1};"
+
             cur = self.conn.cursor()
-            cur.execute(query)
+            cur.execute(exec_query)
             elapsed_ms = (time.perf_counter() - start) * 1000
 
             if cur.description:
@@ -569,6 +643,12 @@ class DatabaseEngine:
                 "error": str(e),
                 "elapsed_ms": round(elapsed_ms, 2),
             }
+        finally:
+            if cur:
+                try:
+                    cur.close()
+                except Exception:
+                    pass
 
     # --- Helpers ---
 

{ghostbase_cli-0.1.2 → ghostbase_cli-0.1.4}/exporter.py

@@ -40,11 +40,14 @@ class Exporter:
         return deduped
 
     @staticmethod
-    def _escape_ident(ident: str) -> str:
+    def _escape_ident(ident: str, dialect: str = "sqlite") -> str:
         s = str(ident).strip()
+        q = "`" if str(dialect).lower() == "mysql" else '"'
+        escaped_q = q * 2
+
         if "." in s:
             parts = s.split(".")
-            return ".".join(f'"{p.replace(chr(34), chr(34)*2)}"' for p in parts)
+            return ".".join(f"{q}{p.replace(q, escaped_q)}{q}" for p in parts)
 
         reserved = {
             "ALL", "ALTER", "AND", "ANY", "AS", "ASC", "BETWEEN", "BY", "CASE",
@@ -59,8 +62,8 @@ class Exporter:
             "USER", "VALUES", "VIEW", "WHEN", "WHERE", "WITH"
         }
         if not s.isidentifier() or s.upper() in reserved:
-            escaped = s.replace('"', '""')
-            return f'"{escaped}"'
+            escaped = s.replace(q, escaped_q)
+            return f"{q}{escaped}{q}"
         return s
 
     @staticmethod
@@ -95,13 +98,13 @@ class Exporter:
                 f.write("| " + " | ".join(clean_cells) + " |\n")
 
     @staticmethod
-    def to_sql_inserts(table_name: str, columns: List[str], rows: List[List[Any]], output_path: str):
+    def to_sql_inserts(table_name: str, columns: List[str], rows: List[List[Any]], output_path: str, dialect: str = "sqlite"):
         table = (table_name or "exported_table").strip()
-        escaped_table = Exporter._escape_ident(table)
-        escaped_cols = [Exporter._escape_ident(c) for c in columns]
+        escaped_table = Exporter._escape_ident(table, dialect=dialect)
+        escaped_cols = [Exporter._escape_ident(c, dialect=dialect) for c in columns]
         cols_str = ", ".join(escaped_cols)
         with open(output_path, "w", encoding="utf-8") as f:
-            f.write(f"-- GhostBase SQL Export: {table}\n")
+            f.write(f"-- GhostBase SQL Export: {table} ({dialect})\n")
             f.write(f"-- Total: {len(rows)} row(s)\n\n")
             for r in rows:
                 vals = []

{ghostbase_cli-0.1.2 → ghostbase_cli-0.1.4}/ghostbase_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ghostbase-cli
-Version: 0.1.2
+Version: 0.1.4
 Summary: A fast, keyboard-driven terminal database studio for SQLite, PostgreSQL & MySQL
 Author-email: 4yk5 <contact.4yk5@proton.me>
 License-Expression: MIT

{ghostbase_cli-0.1.2 → ghostbase_cli-0.1.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ghostbase-cli"
-version = "0.1.2"
+version = "0.1.4"
 description = "A fast, keyboard-driven terminal database studio for SQLite, PostgreSQL & MySQL"
 readme = "README.md"
 authors = [{ name = "4yk5", email = "contact.4yk5@proton.me" }]

{ghostbase_cli-0.1.2 → ghostbase_cli-0.1.4}/tests/test_vulnerabilities_fixed.py

@@ -41,6 +41,21 @@ def test_safe_mode_and_comment_bypass():
     is_dest, r = db.check_safety(dollar_bypass, is_safe_mode=False)
     assert is_dest, f"VULNERABILITY: Dollar-quoted string containing WHERE fooled check_safety: {r}"
 
+    # Postgres dollar-quoted string with tag mismatch ($tag$ vs $other$)
+    mismatched_tag_query = "UPDATE users SET role = $tag$abc $other$ WHERE marker $tag$;"
+    is_dest, r = db.check_safety(mismatched_tag_query, is_safe_mode=False)
+    assert is_dest, f"VULNERABILITY: Dollar-quoted tag mismatch bypassed WHERE check: {r}"
+
+    # Postgres E'...' string with backslash escaped quote
+    e_string_query = "UPDATE users SET role = E'foo\\' WHERE false';"
+    is_dest, r = db.check_safety(e_string_query, is_safe_mode=False)
+    assert is_dest, f"VULNERABILITY: PostgreSQL E-string with escaped quote bypassed WHERE check: {r}"
+
+    # MySQL # comment bypass attempt
+    mysql_comment_query = "UPDATE users SET role = 'Member' # WHERE id = 1\n;"
+    is_dest, r = db.check_safety(mysql_comment_query, is_safe_mode=False)
+    assert is_dest, f"VULNERABILITY: MySQL # comment containing WHERE fooled check_safety: {r}"
+
     # Safe Mode STRICT read-only checks
     safe_queries = [
         "SELECT * FROM users WHERE id = 5;",
@@ -52,6 +67,7 @@ def test_safe_mode_and_comment_bypass():
         is_dest, r = db.check_safety(q, is_safe_mode=True)
         assert not is_dest, f"Safe query wrongly blocked in Safe Mode: {q} ({r})"
 
+    # Safe Mode must strictly block DML, DDL, DO blocks, CALL, MERGE, SET, and state-modifying functions
     unsafe_queries = [
         ("UPDATE users SET role = 'Admin' WHERE id = 5;", "UPDATE"),
         ("INSERT INTO users (name) VALUES ('Test');", "INSERT"),
@@ -61,7 +77,15 @@ def test_safe_mode_and_comment_bypass():
         ("ALTER TABLE users ADD COLUMN age INT;", "ALTER"),
         ("CREATE TABLE test (id INT);", "CREATE"),
         ("SELECT nextval('users_id_seq');", "NEXTVAL"),
+        ("SELECT setval('users_id_seq', 1, false);", "SETVAL"),
+        ("SELECT set_config('default_transaction_read_only', 'off', false);", "SET_CONFIG"),
+        ("SELECT pg_terminate_backend(1234);", "PG_TERMINATE_BACKEND"),
         ("SELECT * INTO OUTFILE '/tmp/f' FROM users;", "INTO OUTFILE"),
+        ("SET default_transaction_read_only = OFF;", "SET"),
+        ("RESET ALL;", "RESET"),
+        ("DO $body$ BEGIN UPDATE users SET role = 'Admin'; END $body$;", "DO"),
+        ("CALL custom_proc();", "CALL"),
+        ("MERGE INTO target USING source ON target.id = source.id WHEN MATCHED THEN DELETE;", "MERGE"),
     ]
     for q, op in unsafe_queries:
         is_dest, r = db.check_safety(q, is_safe_mode=True)
@@ -72,7 +96,7 @@ def test_safe_mode_and_comment_bypass():
 
 
 def test_database_engine_level_readonly():
-    print("[*] 2. Testing Database Engine-Level Read-Only Enforcement...")
+    print("[*] 2. Testing Database Engine-Level Read-Only & Fail-Closed Enforcement...")
     db = DatabaseEngine(":memory:")
     db.conn.execute("CREATE TABLE read_only_test (id INT, val TEXT);")
     db.conn.commit()
@@ -145,22 +169,27 @@ def test_sqlite_foreign_keys_enforced():
 
 
 def test_empty_sqlite_not_polluted():
-    print("[*] 5. Testing Empty SQLite Database Guard in Read-Only Mode...")
+    print("[*] 5. Testing Empty SQLite Database Guard in Read-Only Mode (with actual on_mount)...")
+    import asyncio
     from app import GhostBaseApp
     with tempfile.NamedTemporaryFile(suffix=".db", delete=False) as f:
         empty_db_path = f.name
 
-    try:
-        # Launch in read-only / safe mode
+    async def _run():
         app = GhostBaseApp(db_path=empty_db_path, read_only=True, populate_sample=True)
-        tables = app.db.get_tables()
-        assert len(tables) == 0, f"VULNERABILITY: Sample tables were created during --read-only launch: {tables}"
-        app.db.close()
+        async with app.run_test() as pilot:
+            await pilot.pause(0.1)
+            tables = app.db.get_tables()
+            assert len(tables) == 0, f"VULNERABILITY: Sample tables were created during --read-only launch: {tables}"
+            assert app.safe_mode is True
+
+    try:
+        asyncio.run(_run())
     finally:
         if os.path.exists(empty_db_path):
             os.remove(empty_db_path)
 
-    print("  [+] Empty Database Integrity in Read-Only: PASS")
+    print("  [+] Empty Database Integrity in Read-Only (on_mount verified): PASS")
 
 
 def test_returning_dml_classification():
@@ -180,11 +209,12 @@ def test_returning_dml_classification():
     print("  [+] DML with RETURNING Classification: PASS")
 
 
-def test_exporter_dedup_and_ident_escaping():
-    print("[*] 7. Testing Exporter JSON Types & SQL Identifier Escaping...")
+def test_exporter_json_types_and_dialect_sql():
+    print("[*] 7. Testing Exporter JSON Types & Dialect-Aware SQL Escaping (MySQL vs Postgres/SQLite)...")
     tmp = tempfile.gettempdir()
     json_path = os.path.join(tmp, "test_types.json")
-    sql_path = os.path.join(tmp, "test_escape.sql")
+    sql_pg_path = os.path.join(tmp, "test_pg.sql")
+    sql_my_path = os.path.join(tmp, "test_mysql.sql")
 
     # JSON export with Decimal, datetime, UUID, bytes, and duplicate column names
     cols = ["id", "id", "price", "created", "uid", "raw"]
@@ -206,17 +236,24 @@ def test_exporter_dedup_and_ident_escaping():
     assert data[0]["uid"] == "12345678-1234-5678-1234-567812345678"
     assert data[0]["raw"] == "binary_ghost"
 
-    # SQL export schema-qualified tables & reserved words
+    # PostgreSQL / SQLite dialect SQL export (Double quotes)
     table_name = "analytics.order"
     cols_special = ["first name", "group", "price"]
     rows_special = [["Bob", "Admin", decimal.Decimal("10.50")]]
-    Exporter.to_sql_inserts(table_name, cols_special, rows_special, sql_path)
-    with open(sql_path, "r", encoding="utf-8") as f:
-        sql_content = f.read()
+    Exporter.to_sql_inserts(table_name, cols_special, rows_special, sql_pg_path, dialect="postgresql")
+    with open(sql_pg_path, "r", encoding="utf-8") as f:
+        pg_content = f.read()
+
+    assert 'INSERT INTO "analytics"."order" ("first name", "group", price) VALUES (\'Bob\', \'Admin\', 10.50);' in pg_content
+
+    # MySQL dialect SQL export (Backticks)
+    Exporter.to_sql_inserts(table_name, cols_special, rows_special, sql_my_path, dialect="mysql")
+    with open(sql_my_path, "r", encoding="utf-8") as f:
+        my_content = f.read()
 
-    assert 'INSERT INTO "analytics"."order" ("first name", "group", price) VALUES (\'Bob\', \'Admin\', 10.50);' in sql_content
+    assert 'INSERT INTO `analytics`.`order` (`first name`, `group`, price) VALUES (\'Bob\', \'Admin\', 10.50);' in my_content
 
-    print("  [+] Exporter JSON Types & SQL Escaping: PASS")
+    print("  [+] Exporter JSON Types & Dialect-Aware SQL Escaping: PASS")
 
 
 def test_table_quoting_and_cte_export_detection():
@@ -232,6 +269,7 @@ def test_table_quoting_and_cte_export_detection():
     db_my = DatabaseEngine.__new__(DatabaseEngine)
     db_my.db_type = "mysql"
     assert db_my.quote_table_name("order") == "`order`"
+    assert db_my.quote_table_name("analytics.users") == "`analytics`.`users`"
 
     # CTE target detection test
     cte_query = """
@@ -266,7 +304,7 @@ def test_result_set_memory_limit():
 
 def main():
     print("\n" + "=" * 60)
-    print("RUNNING EXHAUSTIVE REFINED VERIFICATION TESTS (v0.1.2)")
+    print("RUNNING EXHAUSTIVE REFINED VERIFICATION TESTS (v0.1.3)")
     print("=" * 60)
 
     test_safe_mode_and_comment_bypass()
@@ -275,12 +313,12 @@ def main():
     test_sqlite_foreign_keys_enforced()
     test_empty_sqlite_not_polluted()
     test_returning_dml_classification()
-    test_exporter_dedup_and_ident_escaping()
+    test_exporter_json_types_and_dialect_sql()
     test_table_quoting_and_cte_export_detection()
     test_result_set_memory_limit()
 
     print("\n" + "=" * 60)
-    print("ALL 9 CRITICAL & HIGH EDGE CASES VERIFIED AND 100% PASSING!")
+    print("ALL ANALYST VULNERABILITIES VERIFIED AND 100% PASSING!")
     print("=" * 60 + "\n")