4 ms·
The closest thing I'm aware of is a tool by the University of Tartu which does this for Java, described in the paper "An Interactive Tool for Analyzing Embedded
by Darmani 14y ago
The closest thing I'm aware of is a tool by the University of Tartu which does this for Java, described in the paper "An Interactive Tool for Analyzing Embedded SQL Quries." It can find the SQL errors (misspelled "name" and missing space before "AND") in the following code:
public Statement ageFilter(int minimalAge) throws SQLException {
Connection conn = getConnection();
String sql = "SELECT name FROM people WHERE nmae IS NOT NULL";
if (minimalAge > 0)
sql += "AND (age >= " + minimalAge + ")";
return conn.prepareStatement(sql);
}
There are a lot of really interesting challenges in doing this. Their tool uses a powerful technique called "abstract parsing" which can analyze all possible parse trees created by running the SQL parser on a string produced by Java string operations. It's pretty impressive what modern static analysis can do, and just how weak the linters we've gotten used to are in comparison.