Skip to content

fix: don't treat @ inside a string literal as a named parameter in Select - #7827

Open
makoto-developer wants to merge 1 commit into
go-gorm:masterfrom
makoto-developer:fix-select-at-in-string-literal
Open

fix: don't treat @ inside a string literal as a named parameter in Select#7827
makoto-developer wants to merge 1 commit into
go-gorm:masterfrom
makoto-developer:fix-select-at-in-string-literal

Conversation

@makoto-developer

Copy link
Copy Markdown

Description

Fixes #7235

When a string passed to Select contains an @, Select treats the whole statement as a named expression (clause.NamedExpr) and consumes the following arguments as its variables. When those arguments are plain column names, they are silently dropped:

DB.Table("users").Select("name = 'test@example.com' as is_example", "age")
// before: SELECT name = 'test@example.com' as is_example FROM `users`   (age is gone)
// after:  SELECT name = 'test@example.com' as is_example,age FROM `users`

The @ here is part of a string literal, not a named-parameter placeholder.

Fix

Skip the named-expression path when every extra argument is a plain column name (string or []string); in that case a bare @ is just part of the SQL text and the arguments are treated as additional columns, matching the []string form of Select.

Passing actual named arguments (sql.Named, maps, structs) still takes the named-expression path and is unaffected — the existing COALESCE(age, @default) test continues to pass.

Testing

Added TestSelectWithAtInStringLiteral (fails before, passes after). go test ./... passes for both the root module and the tests module; golangci-lint reports no new issues; gofumpt/go vet clean.

…lect

When a string passed to Select contains an @, Select treats the whole
statement as a named expression and consumes the remaining arguments as
variables. If those arguments are plain column names, they are silently
dropped, e.g. Select("name = 'a@b.com' as x", "age") loses the age column.

Skip the named-expression path when every argument is a plain column name
(string or []string); a bare @ is then part of the SQL text. Passing named
arguments (sql.Named, maps, structs) is unaffected.

Fixes go-gorm#7235
@makoto-developer
makoto-developer marked this pull request as ready for review July 26, 2026 02:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Using an @ in a string passed to Select results in incorrect query

1 participant