fraiseql_core/schema/compiled/validation.rs
1/// Validates that a string is a safe SQL identifier.
2///
3/// Accepts only ASCII alphanumerics and underscores (no spaces, semicolons,
4/// hyphens, or other characters). Used to guard against SQL injection when
5/// schema-derived names such as view names or entity type names are
6/// interpolated into raw SQL strings.
7///
8/// # Rules
9/// - Non-empty
10/// - Maximum 128 characters
11/// - All characters are `[A-Za-z0-9_]`
12///
13/// # Examples
14///
15/// ```
16/// use fraiseql_core::schema::is_safe_sql_identifier;
17///
18/// assert!(is_safe_sql_identifier("v_users"));
19/// assert!(is_safe_sql_identifier("Order123"));
20/// assert!(!is_safe_sql_identifier("users; DROP TABLE users"));
21/// assert!(!is_safe_sql_identifier(""));
22/// ```
23#[must_use]
24pub fn is_safe_sql_identifier(name: &str) -> bool {
25 !name.is_empty()
26 && name.len() <= 128
27 && name.chars().all(|c| c.is_ascii_alphanumeric() || c == '_')
28}