【安全加密】SQL 注入防护：参数化查询的强制检查

---危险写法：字符串拼接 SQL
-- local sql = "SELECT * FROM roles WHERE name = '" .. name .. "'"

---参数化写法：占位符加参数绑定
function Role.findByName(name)
    local rows = DB.query("SELECT * FROM roles WHERE name = ?", name)
    return rows[1]
end

---模糊查询的参数化：通配符转义
function Role.search(kw)
    kw = "%" .. kw:gsub("([%%_])", "\\%1") .. "%"
    return DB.query(
        "SELECT name, level FROM roles WHERE name LIKE ? ESCAPE '\\'", kw)
end

---输入的合法性前置校验
local NAME_PATTERN = "^[%w%p]+$"

function Role.validateName(name)
    if #name < 2 or #name > 16 then
        return false, "名字长度须在 2 到 16 个字符"
    end
    if not name:match(NAME_PATTERN) then
        return false, "名字含非法字符"
    end
    local banned = { [";"] = true, ["'"] = true, ["--"] = true }
    for k in pairs(banned) do
        if name:find(k, 1, true) then
            return false, "名字含非法字符"
        end
    end
    return true
end