From ddefed03e64c6888fab8957529bb195302330ef8 Mon Sep 17 00:00:00 2001
From: Tobie Morgan Hitchcock <tobie@abcum.com>
Date: Wed, 30 May 2018 19:06:48 +0100
Subject: [PATCH] =?UTF-8?q?Don=E2=80=99t=20allow=20use=20of=20$=20param=20?=
 =?UTF-8?q?with=20no=20value=20in=20queries?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Beforehand it was possible to do  SELECT * FROM $  which would show all of the variables defined. This is now not possible, and variables must be specified using their defined name.
---
 db/fetch.go | 36 ++++++++++++++++++++----------------
 1 file changed, 20 insertions(+), 16 deletions(-)

diff --git a/db/fetch.go b/db/fetch.go
index c9247331..5e43858f 100644
--- a/db/fetch.go
+++ b/db/fetch.go
@@ -106,28 +106,32 @@ func (e *executor) fetch(ctx context.Context, val interface{}, doc *data.Doc) (o
 
 	case *sql.Param:
 
-		for _, s := range paramSearchKeys {
+		if len(val.ID) > 0 {
 
-			if obj, ok := ctx.Value(s).(*data.Doc); ok {
+			for _, s := range paramSearchKeys {
 
-				fnc := func(key string, val interface{}, path []string) interface{} {
-					if len(path) > 0 {
-						switch res := val.(type) {
-						case []interface{}:
-							val, _ = e.fetchArray(ctx, res, doc)
-							return val
-						case *sql.Thing:
-							val, _ = e.fetchThing(ctx, res, doc)
-							return val
+				if obj, ok := ctx.Value(s).(*data.Doc); ok {
+
+					fnc := func(key string, val interface{}, path []string) interface{} {
+						if len(path) > 0 {
+							switch res := val.(type) {
+							case []interface{}:
+								val, _ = e.fetchArray(ctx, res, doc)
+								return val
+							case *sql.Thing:
+								val, _ = e.fetchThing(ctx, res, doc)
+								return val
+							}
 						}
+						return val
 					}
-					return val
-				}
 
-				res := obj.Fetch(fnc, val.ID).Data()
+					res := obj.Fetch(fnc, val.ID).Data()
+
+					if res != nil {
+						return e.fetch(ctx, res, doc)
+					}
 
-				if res != nil {
-					return e.fetch(ctx, res, doc)
 				}
 
 			}