[chiliec]

Summary

LibSqlUtils.escape() doubles single quotes for values that get embedded into concatenated metadata SQL (e.g. pragma index_list(' + escape(table) + '), pragma index_info(...), pragma foreign_key_list(...), and the string-built getPrimaryKeys / getImportedKeys / getExportedKeys queries in LibSqlDatabaseMetaData).

The early-return guard was:

if (val.indexOf('\'') == 1) {
    return val;
}

The intent is "return unchanged when there is no quote to escape", which is indexOf(...) == -1. As written (== 1), any value whose first single quote is at index 1 — e.g. x' or x' OR '1'='1 — is returned un-escaped, so the quote is not doubled and closes the surrounding SQL string literal.

Fix

Change the guard to == -1 so the fast path is taken only when the value contains no single quote; otherwise every quote is doubled as intended.

Behaviour

input	before	after
x'	x' (unescaped)	x''
x' OR '1'='1	x' OR '1'='1 (unescaped)	x'' OR ''1''=''1
table	table	table
'ab	''ab	''ab

Tests

Added LibSqlUtilsTest#testEscape covering quotes at the start, middle, end, and the index-1 regression case. The regression assertions fail on the previous == 1 code and pass with this change.

I noticed this while reading the code. The un-escaped path affects identifier values flowing into concatenated metadata queries; the one-line guard fix plus the added tests close it. Happy to adjust anything.

---

I'm a TS/Go/Swift/Kotlin engineer and currently open to remote contract work. If DBeaver could use an extra pair of hands, I'd be glad to talk.

[LonwoLonwo]

Thanks for the request @chiliec

Sorry for the late response. We will take a look

[E1izabeth]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T10:15:14.386643Z	666d61c	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 666d61c4a3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Destrolaric]

@chiliec, hi, could you please fix the commit names? They should be a

dbeaver/dbeaver-jdbc-libsql#issueNumber commit text (you should create an issue).

This is required for CI checks

[chiliec]

Done — opened #68 and renamed the commit to dbeaver/dbeaver-jdbc-libsql#68 fix(libsql): correct escape() no-quote guard (was == 1, should be == -1). Also rebased onto the current devel so the branch is a single commit again. New head: 0ba33a6. Code is unchanged from the version you approved.