Incompatibilities to mysql2 / Missing Migration notices

[kinsi55]

I've been using mysql2 so far and decided to give this project a try

namedPlaceholders

setting namedPlaceholders to true in the connection has a different behaviour to mysql2:

In mysql2 this is an implicit opt-in: Setting to to true still allows you to use ? placeholders

Bulk insert via query()

In Mysql2 you can INSERT INTO foo(bar) VALUES ? and then pass [[["baz"],["qux"]]] as the value and it will automatically destructure that to a bulk insert

Insert from Object

In Mysql2 you can INSERT INTO foo SET ? and then pass {bar: "baz"} as the value which will then automatically get destructured to SET bar = "baz"

---

These things do not work in Mariadb, at least not 1:1. namedPlaceholders isnt a big deal, #2 ofc has the batch() replacement, having insert from object back tho would be great :D

[rusher]

Thanks for reporting this.
About namedPlaceholders compatibility, this will be done in https://jira.mariadb.org/browse/CONJS-313

for the others things, i don't think this is a good idea.

• about the 'Insert from Object', this is a security issue, there is one option permitSetMultiParamEntries, that if enable permit that behavior, but this can easily lead to injection. So option exists for compatibility, but not recommended.
• for bulk insert, implementing this might lead to injection as well. Having a dedicated batch function is the prefered way, because it clearly state what the role for that function, ensuring proper parameter validation (and permit using dedicated mariadb batching, way faster)

[kinsi55]

For Objects: Surely the passed value is escaped, right? I wouldnt ever pass in unsanitized user-keys, but I would expect values to be escaped - In that case it just allows for more DRY code as otherwise you need to have the column names in the SQL as well as a blob of ?'s of which there could be quite a bit which is just not great
For Bulk insert: Yeah its not a big deal like I said - Possibly it should throw a descriptive error message tho!

[rusher]

Of course, it's escaped, but this still open issue that wouldn't have exists otherwise, and not compatible with execute() command. the goal is having any command working with connection.query to works exactly the same with connection.execute