Parsing SQL - before I write my own

L

Laurel

I need a routine that will break apart the clauses in a
SQL statement, so I can modify some and put it back to
gether. (E.g., I need to insert a WHERE clause between
the SELECT and ORDER BY). This isn't rocket science, but
my experience has been that it's common enough that
routines exist in shareware, etc., in other languages.
Access is so rich in web sites with free code, but I
haven't found such a routine. Does anyone know where I
could find one before I re-invent the wheel and write my
own?
 
J

Joe Fallon

I do not "parse" the string so much as build it on the fly in code.

For example:
Dim strSQL As String
Dim strWhere As String

strWhere = Forms![FormName]![txtWhere]

strSQL = "SELECT field1 "
strSQL = strSQL & "FROM MyTable "
strSQL = strSQL & "WHERE " & strWhere
strSQL = strSQL & "ORDER BY field1 "

As you can see if the user enters a valid Where clause in the form the SQL
command runs correctly.

There are many variations on this theme.

One thing to be very careful about is a SQL Injection attack. (A malacious
user could enter in some very naughty SQL that is "valid" but wreaks havoc
on your database.)
 
J

John Vinson

One thing to be very careful about is a SQL Injection attack. (A malacious
user could enter in some very naughty SQL that is "valid" but wreaks havoc
on your database.)

.... like DELETE * FROM Cat; on an Oracle database? <g>
 
L

Laurel

Maybe I wasn't clear. I need to take pre-existing SQL
(the base SQL Select for various charts), and insert the
WHERE clause. Some of this pre-existing SQL has ORDER BY
clauses, for an example, so I can't just tack the WHERE
clause on the end. Since I have to parse the pre-existing
SQL that much, I thought I'd look for a procedure that
breaks it into all its parts. Like I said, I've seen such
functionality in other languages. Sometimes it's bundled
in with the language itself.
-----Original Message-----
I do not "parse" the string so much as build it on the fly in code.

For example:
Dim strSQL As String
Dim strWhere As String

strWhere = Forms![FormName]![txtWhere]

strSQL = "SELECT field1 "
strSQL = strSQL & "FROM MyTable "
strSQL = strSQL & "WHERE " & strWhere
strSQL = strSQL & "ORDER BY field1 "

As you can see if the user enters a valid Where clause in the form the SQL
command runs correctly.

There are many variations on this theme.

One thing to be very careful about is a SQL Injection attack. (A malacious
user could enter in some very naughty SQL that is "valid" but wreaks havoc
on your database.)

--
Joe Fallon
Access MVP



I need a routine that will break apart the clauses in a
SQL statement, so I can modify some and put it back to
gether. (E.g., I need to insert a WHERE clause between
the SELECT and ORDER BY). This isn't rocket science, but
my experience has been that it's common enough that
routines exist in shareware, etc., in other languages.
Access is so rich in web sites with free code, but I
haven't found such a routine. Does anyone know where I
could find one before I re-invent the wheel and write my
own?


.
 
D

Dan Artuso

Hi,
Sometimes it takes less time to write your own than to wait days to find a pre-written routine, plus
you always learn something when you write your own.

Place this in a standard module:

Public Sub ParseSql(strSqlIn As String, mainSqlOut As String, orderByOut As String)

If InStr(1, strSqlIn, "Order By", vbTextCompare) <> 0 Then
mainSqlout = Trim(Left(strSqlIn, InStr(1, strSqlIn, "Order By", vbTextCompare) - 1))
orderByOut = Trim(Mid(strSqlIn, InStr(1, strSqlIn, "Order By", vbTextCompare)))
Else
mainSqlOut = strSqlIn
orderByOut = ""
End If
End Sub

Call it like this:
Dim strSql As String
Dim strOrderBy As String

'ParseSql "Select * From table1 Order By something", strSql, strOrderBy
'ParseSql "Select * From table1", strSql, strOrderBy
MsgBox strSql
MsgBox strOrderBy



--
HTH
Dan Artuso, Access MVP


Laurel said:
Maybe I wasn't clear. I need to take pre-existing SQL
(the base SQL Select for various charts), and insert the
WHERE clause. Some of this pre-existing SQL has ORDER BY
clauses, for an example, so I can't just tack the WHERE
clause on the end. Since I have to parse the pre-existing
SQL that much, I thought I'd look for a procedure that
breaks it into all its parts. Like I said, I've seen such
functionality in other languages. Sometimes it's bundled
in with the language itself.
-----Original Message-----
I do not "parse" the string so much as build it on the fly in code.

For example:
Dim strSQL As String
Dim strWhere As String

strWhere = Forms![FormName]![txtWhere]

strSQL = "SELECT field1 "
strSQL = strSQL & "FROM MyTable "
strSQL = strSQL & "WHERE " & strWhere
strSQL = strSQL & "ORDER BY field1 "

As you can see if the user enters a valid Where clause in the form the SQL
command runs correctly.

There are many variations on this theme.

One thing to be very careful about is a SQL Injection attack. (A malacious
user could enter in some very naughty SQL that is "valid" but wreaks havoc
on your database.)

--
Joe Fallon
Access MVP



I need a routine that will break apart the clauses in a
SQL statement, so I can modify some and put it back to
gether. (E.g., I need to insert a WHERE clause between
the SELECT and ORDER BY). This isn't rocket science, but
my experience has been that it's common enough that
routines exist in shareware, etc., in other languages.
Access is so rich in web sites with free code, but I
haven't found such a routine. Does anyone know where I
could find one before I re-invent the wheel and write my
own?


.
 
L

Laurel

Thanks for sharing. I'll take this and get off and
running with my project.
-----Original Message-----
Hi,
Sometimes it takes less time to write your own than to
wait days to find a pre-written routine, plus
you always learn something when you write your own.

Place this in a standard module:

Public Sub ParseSql(strSqlIn As String, mainSqlOut As String, orderByOut As String)

If InStr(1, strSqlIn, "Order By", vbTextCompare) <> 0 Then
mainSqlout = Trim(Left(strSqlIn, InStr(1,
strSqlIn, "Order By", vbTextCompare) - 1))
orderByOut = Trim(Mid(strSqlIn, InStr(1,
strSqlIn, "Order By", vbTextCompare)))
Else
mainSqlOut = strSqlIn
orderByOut = ""
End If
End Sub

Call it like this:
Dim strSql As String
Dim strOrderBy As String

'ParseSql "Select * From table1 Order By something", strSql, strOrderBy
'ParseSql "Select * From table1", strSql, strOrderBy
MsgBox strSql
MsgBox strOrderBy



--
HTH
Dan Artuso, Access MVP


"Laurel" <[email protected]> wrote in
message news:[email protected]...
Maybe I wasn't clear. I need to take pre-existing SQL
(the base SQL Select for various charts), and insert the
WHERE clause. Some of this pre-existing SQL has ORDER BY
clauses, for an example, so I can't just tack the WHERE
clause on the end. Since I have to parse the pre- existing
SQL that much, I thought I'd look for a procedure that
breaks it into all its parts. Like I said, I've seen such
functionality in other languages. Sometimes it's bundled
in with the language itself.
-----Original Message-----
I do not "parse" the string so much as build it on the fly in code.

For example:
Dim strSQL As String
Dim strWhere As String

strWhere = Forms![FormName]![txtWhere]

strSQL = "SELECT field1 "
strSQL = strSQL & "FROM MyTable "
strSQL = strSQL & "WHERE " & strWhere
strSQL = strSQL & "ORDER BY field1 "

As you can see if the user enters a valid Where clause
in
the form the SQL
command runs correctly.

There are many variations on this theme.

One thing to be very careful about is a SQL Injection attack. (A malacious
user could enter in some very naughty SQL that
is "valid"
but wreaks havoc
on your database.)

--
Joe Fallon
Access MVP



I need a routine that will break apart the clauses in a
SQL statement, so I can modify some and put it back to
gether. (E.g., I need to insert a WHERE clause between
the SELECT and ORDER BY). This isn't rocket science, but
my experience has been that it's common enough that
routines exist in shareware, etc., in other languages.
Access is so rich in web sites with free code, but I
haven't found such a routine. Does anyone know where I
could find one before I re-invent the wheel and write my
own?


.


.>Th
 
L

Laurel

P.S. - I've gone ahead with my project, and gratefully
used your snippet, but I did want to point out that what I
was looking for wasn't a simple search for "ORDER BY",
but, rather, a routine that would return the SELECT clause
and the WHERE clause and the ORDER BY clause, etc., etc.,
etc. so that you could manipulate the whole thing for a
variety of purposes. But, 24 hours is long enough to
wait. Thanks again.
-----Original Message-----
Hi,
Sometimes it takes less time to write your own than to
wait days to find a pre-written routine, plus
you always learn something when you write your own.

Place this in a standard module:

Public Sub ParseSql(strSqlIn As String, mainSqlOut As String, orderByOut As String)

If InStr(1, strSqlIn, "Order By", vbTextCompare) <> 0 Then
mainSqlout = Trim(Left(strSqlIn, InStr(1,
strSqlIn, "Order By", vbTextCompare) - 1))
orderByOut = Trim(Mid(strSqlIn, InStr(1,
strSqlIn, "Order By", vbTextCompare)))
Else
mainSqlOut = strSqlIn
orderByOut = ""
End If
End Sub

Call it like this:
Dim strSql As String
Dim strOrderBy As String

'ParseSql "Select * From table1 Order By something", strSql, strOrderBy
'ParseSql "Select * From table1", strSql, strOrderBy
MsgBox strSql
MsgBox strOrderBy



--
HTH
Dan Artuso, Access MVP


"Laurel" <[email protected]> wrote in
message news:[email protected]...
Maybe I wasn't clear. I need to take pre-existing SQL
(the base SQL Select for various charts), and insert the
WHERE clause. Some of this pre-existing SQL has ORDER BY
clauses, for an example, so I can't just tack the WHERE
clause on the end. Since I have to parse the pre- existing
SQL that much, I thought I'd look for a procedure that
breaks it into all its parts. Like I said, I've seen such
functionality in other languages. Sometimes it's bundled
in with the language itself.
-----Original Message-----
I do not "parse" the string so much as build it on the fly in code.

For example:
Dim strSQL As String
Dim strWhere As String

strWhere = Forms![FormName]![txtWhere]

strSQL = "SELECT field1 "
strSQL = strSQL & "FROM MyTable "
strSQL = strSQL & "WHERE " & strWhere
strSQL = strSQL & "ORDER BY field1 "

As you can see if the user enters a valid Where clause
in
the form the SQL
command runs correctly.

There are many variations on this theme.

One thing to be very careful about is a SQL Injection attack. (A malacious
user could enter in some very naughty SQL that
is "valid"
but wreaks havoc
on your database.)

--
Joe Fallon
Access MVP



I need a routine that will break apart the clauses in a
SQL statement, so I can modify some and put it back to
gether. (E.g., I need to insert a WHERE clause between
the SELECT and ORDER BY). This isn't rocket science, but
my experience has been that it's common enough that
routines exist in shareware, etc., in other languages.
Access is so rich in web sites with free code, but I
haven't found such a routine. Does anyone know where I
could find one before I re-invent the wheel and write my
own?


.


.
 
D

Dan Artuso

Hi,
It gets a bit more complicated to make it totaly generic.
After all, the SQL you pass it may not contain an ORDER BY or
it may contain an ORDER BY with no WHERE clause or it may contain
both. On top of that, beacuse the number of seperate strings returned by the parser
will be unknown, you'll have to use an array to return them (or create parameters for each possible
one, but that's not really practical).
It's best to write a limited parser that meets whatever specs you decide on.
A totally generic one is a lot of work which is why I suspect you haven't found one.

--
HTH
Dan Artuso, Access MVP


Laurel said:
P.S. - I've gone ahead with my project, and gratefully
used your snippet, but I did want to point out that what I
was looking for wasn't a simple search for "ORDER BY",
but, rather, a routine that would return the SELECT clause
and the WHERE clause and the ORDER BY clause, etc., etc.,
etc. so that you could manipulate the whole thing for a
variety of purposes. But, 24 hours is long enough to
wait. Thanks again.
-----Original Message-----
Hi,
Sometimes it takes less time to write your own than to
wait days to find a pre-written routine, plus
you always learn something when you write your own.

Place this in a standard module:

Public Sub ParseSql(strSqlIn As String, mainSqlOut As String, orderByOut As String)

If InStr(1, strSqlIn, "Order By", vbTextCompare) <> 0 Then
mainSqlout = Trim(Left(strSqlIn, InStr(1,
strSqlIn, "Order By", vbTextCompare) - 1))
orderByOut = Trim(Mid(strSqlIn, InStr(1,
strSqlIn, "Order By", vbTextCompare)))
Else
mainSqlOut = strSqlIn
orderByOut = ""
End If
End Sub

Call it like this:
Dim strSql As String
Dim strOrderBy As String

'ParseSql "Select * From table1 Order By something", strSql, strOrderBy
'ParseSql "Select * From table1", strSql, strOrderBy
MsgBox strSql
MsgBox strOrderBy



--
HTH
Dan Artuso, Access MVP


"Laurel" <[email protected]> wrote in
message news:[email protected]...
Maybe I wasn't clear. I need to take pre-existing SQL
(the base SQL Select for various charts), and insert the
WHERE clause. Some of this pre-existing SQL has ORDER BY
clauses, for an example, so I can't just tack the WHERE
clause on the end. Since I have to parse the pre- existing
SQL that much, I thought I'd look for a procedure that
breaks it into all its parts. Like I said, I've seen such
functionality in other languages. Sometimes it's bundled
in with the language itself.

-----Original Message-----
I do not "parse" the string so much as build it on the
fly in code.

For example:
Dim strSQL As String
Dim strWhere As String

strWhere = Forms![FormName]![txtWhere]

strSQL = "SELECT field1 "
strSQL = strSQL & "FROM MyTable "
strSQL = strSQL & "WHERE " & strWhere
strSQL = strSQL & "ORDER BY field1 "

As you can see if the user enters a valid Where clause in
the form the SQL
command runs correctly.

There are many variations on this theme.

One thing to be very careful about is a SQL Injection
attack. (A malacious
user could enter in some very naughty SQL that is "valid"
but wreaks havoc
on your database.)

--
Joe Fallon
Access MVP



message
I need a routine that will break apart the clauses in a
SQL statement, so I can modify some and put it back to
gether. (E.g., I need to insert a WHERE clause between
the SELECT and ORDER BY). This isn't rocket science,
but
my experience has been that it's common enough that
routines exist in shareware, etc., in other languages.
Access is so rich in web sites with free code, but I
haven't found such a routine. Does anyone know where I
could find one before I re-invent the wheel and write my
own?


.


.
 
A

Albert D. Kallal

Also, don't forget to check out the "buildcriteria" function in the help.

It is a real time saver when having to format dates, and other conditions.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top