DLA SQL分析函数:SQL语句审计与分析的利器

Posted zhaowei121

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了DLA SQL分析函数:SQL语句审计与分析的利器相关的知识,希望对你有一定的参考价值。

1. 简介

Data Lake Analytics(https://www.aliyun.com/product/datalakeanalytics)最新release一组SQL内置函数,用来进行SQL语句的分析、信息提取,方便用户对SQL语句进行语法层面的审计、分析,可以应用于很多安全、数据库日志分析等场景。参考DLA(Data Lake Analytics)之前的文档,只要您的SQL语句文本保存在DLA支持的数据源系统中,就能使用DLA的SQL分析函数,方便、快捷的进行SQL语句的审计和分析,或者基于此构建相关应用程序和系统。

前提条件,您的SQL语句文本已经作为一个字符串、文本字段存储在DLA支持的数据源中,或者在统一格式的日志文件中,日志文件放到OSS中(应用自己上传、开源日志工具上传、日志服务投递(https://help.aliyun.com/document_detail/107980.html)、Datahub投递等),然后采用DLA进行SQL分析。

2. SQL分析函数详解

所有提供的SQL分析函数都是scalar标量函数。SQL分析函数支持多种SQL方言,默认SQL方言是mysql

SQL方言
mysql
postgresql
oracle
db2
sqlserver
hive
odps

支持的函数列表:

NameDescription
sql_export_columns 提取SQL语句中所有出现的列
sql_export_functions 提取SQL语句中所有出现的函数
sql_export_predicate_columns 提取SQL语句中所有出现的谓词条件表达式涉及的列
sql_export_predicates 提取SQL语句中所有出现的谓词条件表达式
sql_export_select_list_columns 提取SQL语句中SELECT子句表达式中出现的列(包括子查询)
sql_export_tables 提取SQL语句中所有出现的表
sql_format 对SQL语句进行格式化
sql_params 提取SQL语句中所有的literal值
sql_pattern 提取SQL语句参数化后的SQL pattern,literal用?代替
sql_pattern_hash 提取sqlText的SQL语句参数化后的SQL pattern,并生成hash值
sql_syntax_check 对sqlText进行语法检查

2.1 sql_export_columns

函数调用形式:

  • sql_export_columns(sqlText)
  • sql_export_columns(sqlText, dbType)
  • sql_export_columns(sqlText, dbType, throwError)

参数说明:

参数名类型说明
sqlText VARCHAR 必选
dbType VARCHAR 可选。SQL方言,默认为mysql
throwError BOOLEAN 可选。true时,遇到非法SQL抛出异常;false时,遇到非法SQL不抛出异常,返回null

返回值:

类型说明
VARCHAR sqlText的SQL语句中所有出现的列,用逗号分隔,列所属的表会进行关联推导,如果没有找到明确的表,则为UNKNOWN

示例:

SELECT sql_export_columns(a.sql_text)
FROM (
SELECT ‘SELECT   s_acctbal, 
         s_name, 
         n_name, 
         p_partkey, 
         p_mfgr, 
         s_address, 
         s_phone, 
         s_comment 
FROM     part, 
         supplier, 
         partsupp, 
         nation, 
         region 
WHERE    p_partkey = ps_partkey 
AND      s_suppkey = ps_suppkey 
AND      p_size = 35 
AND      p_type LIKE ‘‘%NICKEL‘‘ 
AND      s_nationkey = n_nationkey 
AND      n_regionkey = r_regionkey 
AND      r_name = ‘‘MIDDLE EAST‘‘ 
AND      ps_supplycost IN 
         ( 
                SELECT min(ps_supplycost) 
                FROM   partsupp, 
                       supplier, 
                       nation, 
                       region 
                WHERE  s_suppkey = ps_suppkey 
                AND    s_nationkey = n_nationkey 
                AND    n_regionkey = r_regionkey 
                AND    r_name = ‘‘MIDDLE EAST‘‘ ) 
ORDER BY s_acctbal DESC, 
         n_name, 
         s_name, 
         p_partkey 
LIMIT    100;‘ AS sql_text
) a;

+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| sql_export_columns(a.sql_text)                                                                                                                                                                                                                                                                                                                  |
+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| UNKNOWN.s_acctbal,UNKNOWN.s_name,UNKNOWN.n_name,UNKNOWN.p_partkey,UNKNOWN.p_mfgr,UNKNOWN.s_address,UNKNOWN.s_phone,UNKNOWN.s_comment,UNKNOWN.ps_partkey,UNKNOWN.s_suppkey,UNKNOWN.ps_suppkey,UNKNOWN.p_size,UNKNOWN.p_type,UNKNOWN.s_nationkey,UNKNOWN.n_nationkey,UNKNOWN.n_regionkey,UNKNOWN.r_regionkey,UNKNOWN.r_name,UNKNOWN.ps_supplycost |
+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
技术图片技术图片

2.2 sql_export_functions

函数调用形式:

  • sql_export_functions(sqlText)
  • sql_export_functions(sqlText, dbType)
  • sql_export_functions(sqlText, dbType, throwError)

参数说明:

参数名类型说明
sqlText VARCHAR 必选
dbType VARCHAR 可选。SQL方言,默认为mysql
throwError BOOLEAN 可选。true时,遇到非法SQL抛出异常;false时,遇到非法SQL不抛出异常,返回null

返回值:

类型说明
VARCHAR sqlText的SQL语句中所有出现的函数名,用逗号分隔,列所属的表会进行关联推导,如果没有找到明确的表,则为UNKNOWN

示例:

SELECT sql_export_functions(a.sql_text)
FROM (
SELECT ‘SELECT   s_acctbal, 
         s_name, 
         n_name, 
         p_partkey, 
         p_mfgr, 
         s_address, 
         s_phone, 
         s_comment 
FROM     part, 
         supplier, 
         partsupp, 
         nation, 
         region 
WHERE    p_partkey = ps_partkey 
AND      s_suppkey = ps_suppkey 
AND      p_size = 35 
AND      p_type LIKE ‘‘%NICKEL‘‘ 
AND      s_nationkey = n_nationkey 
AND      n_regionkey = r_regionkey 
AND      r_name = ‘‘MIDDLE EAST‘‘ 
AND      ps_supplycost IN 
         ( 
                SELECT min(ps_supplycost) 
                FROM   partsupp, 
                       supplier, 
                       nation, 
                       region 
                WHERE  s_suppkey = ps_suppkey 
                AND    s_nationkey = n_nationkey 
                AND    n_regionkey = r_regionkey 
                AND    r_name = ‘‘MIDDLE EAST‘‘ ) 
ORDER BY s_acctbal DESC, 
         n_name, 
         s_name, 
         p_partkey 
LIMIT    100;‘ AS sql_text
) a;

+----------------------------------+
| sql_export_functions(a.sql_text) |
+----------------------------------+
| min                              |
+----------------------------------+
技术图片技术图片

2.3 sql_export_predicate_columns

函数调用形式:

  • sql_export_predicate_columns(sqlText)
  • sql_export_predicate_columns(sqlText, dbType)
  • sql_export_predicate_columns(sqlText, dbType, throwError)

参数说明:

参数名类型说明
sqlText VARCHAR 必选
dbType VARCHAR 可选。SQL方言,默认为mysql
throwError BOOLEAN 可选。true时,遇到非法SQL抛出异常;false时,遇到非法SQL不抛出异常,返回null

返回值:

类型说明
VARCHAR sqlText的SQL语句中出现在谓词条件表达式中的列名,用逗号分隔,列所属的表会进行关联推导,如果没有找到明确的表,则为UNKNOWN

示例:

SELECT sql_export_predicate_columns(a.sql_text)
FROM (
SELECT ‘SELECT   s_acctbal, 
         s_name, 
         n_name, 
         p_partkey, 
         p_mfgr, 
         s_address, 
         s_phone, 
         s_comment 
FROM     part, 
         supplier, 
         partsupp, 
         nation, 
         region 
WHERE    p_partkey = ps_partkey 
AND      s_suppkey = ps_suppkey 
AND      p_size = 35 
AND      p_type LIKE ‘‘%NICKEL‘‘ 
AND      s_nationkey = n_nationkey 
AND      n_regionkey = r_regionkey 
AND      r_name = ‘‘MIDDLE EAST‘‘ 
AND      ps_supplycost IN 
         ( 
                SELECT min(ps_supplycost) 
                FROM   partsupp, 
                       supplier, 
                       nation, 
                       region 
                WHERE  s_suppkey = ps_suppkey 
                AND    s_nationkey = n_nationkey 
                AND    n_regionkey = r_regionkey 
                AND    r_name = ‘‘MIDDLE EAST‘‘ ) 
ORDER BY s_acctbal DESC, 
         n_name, 
         s_name, 
         p_partkey 
LIMIT    100;‘ AS sql_text
) a;

+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| sql_export_predicate_columns(a.sql_text)                                                                                                                                                                                     |
+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| UNKNOWN.p_partkey,UNKNOWN.ps_partkey,UNKNOWN.s_suppkey,UNKNOWN.ps_suppkey,UNKNOWN.p_size,UNKNOWN.p_type,UNKNOWN.s_nationkey,UNKNOWN.n_nationkey,UNKNOWN.n_regionkey,UNKNOWN.r_regionkey,UNKNOWN.r_name,UNKNOWN.ps_supplycost |
+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
技术图片技术图片

2.4 sql_export_predicates

函数调用形式:

  • sql_export_predicates(sqlText)
  • sql_export_predicates(sqlText, dbType)
  • sql_export_predicates(sqlText, dbType, compactValues)
  • sql_export_predicates(sqlText, dbType, compactValues, throwError)

参数说明:

参数名类型说明
sqlText VARCHAR 必选
dbType VARCHAR 可选。SQL方言,默认为mysql
compactValues BOOLEAN 可选。true时,谓词条件中值以数组的形式出现在返回值中
throwError BOOLEAN 可选。true时,遇到非法SQL抛出异常;false时,遇到非法SQL不抛出异常,返回null

返回值:

类型说明
VARCHAR sqlText的SQL语句中所有出现的谓词条件表达式元素数组,用逗号分隔,列所属的表会进行关联推导,如果没有找到明确的表,则为UNKNOWN

示例:

SELECT sql_export_predicates(a.sql_text, ‘mysql‘, true)
FROM (
SELECT ‘SELECT   s_acctbal, 
         s_name, 
         n_name, 
         p_partkey, 
         p_mfgr, 
         s_address, 
         s_phone, 
         s_comment 
FROM     part, 
         supplier, 
         partsupp, 
         nation, 
         region 
WHERE    p_partkey = ps_partkey 
AND      s_suppkey = ps_suppkey 
AND      p_size = 35 
AND      p_type LIKE ‘‘%NICKEL‘‘ 
AND      s_nationkey = n_nationkey 
AND      n_regionkey = r_regionkey 
AND      r_name = ‘‘MIDDLE EAST‘‘ 
AND      ps_supplycost IN 
         ( 
                SELECT min(ps_supplycost) 
                FROM   partsupp, 
                       supplier, 
                       nation, 
                       region 
                WHERE  s_suppkey = ps_suppkey 
                AND    s_nationkey = n_nationkey 
                AND    n_regionkey = r_regionkey 
                AND    r_name = ‘‘MIDDLE EAST‘‘ ) 
ORDER BY s_acctbal DESC, 
         n_name, 
         s_name, 
         p_partkey 
LIMIT    100;‘ AS sql_text
) a;

+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| sql_export_predicates(a.sql_text)                                                                                                                                                                                                                                                                                                                                                                                                                  |
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| [["UNKNOWN","p_partkey","=",null],["UNKNOWN","ps_partkey","=",null],["UNKNOWN","s_suppkey","=",null],["UNKNOWN","ps_suppkey","=",null],["UNKNOWN","p_size","=",35],["UNKNOWN","p_type","LIKE","%NICKEL"],["UNKNOWN","s_nationkey","=",null],["UNKNOWN","n_nationkey","=",null],["UNKNOWN","n_regionkey","=",null],["UNKNOWN","r_regionkey","=",null],["UNKNOWN","r_name","=",["MIDDLE EAST","MIDDLE EAST"]],["UNKNOWN","ps_supplycost","IN",null]] |
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
技术图片技术图片

2.5 sql_export_select_list_columns

函数调用形式:

  • sql_export_select_list_columns(sqlText)
  • sql_export_select_list_columns(sqlText, dbType)
  • sql_export_select_list_columns(sqlText, dbType, throwError)

参数说明:

参数名类型说明
sqlText VARCHAR 必选
dbType VARCHAR 可选。SQL方言,默认为mysql
throwError BOOLEAN 可选。true时,遇到非法SQL抛出异常;false时,遇到非法SQL不抛出异常,返回null

返回值:

类型说明
VARCHAR sqlText的SQL语句中SELECT子句返回列中出现的列名列表(包括子查询),用逗号分隔,列所属的表会进行关联推导,如果没有找到明确的表,则为UNKNOWN

示例:

SELECT sql_export_select_list_columns(a.sql_text)
FROM (
SELECT ‘SELECT   s_acctbal, 
         s_name, 
         n_name, 
         p_partkey, 
         p_mfgr, 
         s_address, 
         s_phone, 
         s_comment 
FROM     part, 
         supplier, 
         partsupp, 
         nation, 
         region 
WHERE    p_partkey = ps_partkey 
AND      s_suppkey = ps_suppkey 
AND      p_size = 35 
AND      p_type LIKE ‘‘%NICKEL‘‘ 
AND      s_nationkey = n_nationkey 
AND      n_regionkey = r_regionkey 
AND      r_name = ‘‘MIDDLE EAST‘‘ 
AND      ps_supplycost IN 
         ( 
                SELECT min(ps_supplycost) 
                FROM   partsupp, 
                       supplier, 
                       nation, 
                       region 
                WHERE  s_suppkey = ps_suppkey 
                AND    s_nationkey = n_nationkey 
                AND    n_regionkey = r_regionkey 
                AND    r_name = ‘‘MIDDLE EAST‘‘ ) 
ORDER BY s_acctbal DESC, 
         n_name, 
         s_name, 
         p_partkey 
LIMIT    100;‘ AS sql_text
) a;

+------------------------------------------------------------------------------------------------------------------------------------------------------------+
| sql_export_select_list_columns(a.sql_text)                                                                                                                 |
+------------------------------------------------------------------------------------------------------------------------------------------------------------+
| UNKNOWN.s_acctbal,UNKNOWN.s_name,UNKNOWN.n_name,UNKNOWN.p_partkey,UNKNOWN.p_mfgr,UNKNOWN.s_address,UNKNOWN.s_phone,UNKNOWN.s_comment,UNKNOWN.ps_supplycost |
+------------------------------------------------------------------------------------------------------------------------------------------------------------+
技术图片技术图片

2.6 sql_export_tables

函数调用形式:

  • sql_export_tables(sqlText)
  • sql_export_tables(sqlText, dbType)
  • sql_export_tables(sqlText, dbType, throwError)

参数说明:

参数名类型说明
sqlText VARCHAR 必选
dbType VARCHAR 可选。SQL方言,默认为mysql
throwError BOOLEAN 可选。true时,遇到非法SQL抛出异常;false时,遇到非法SQL不抛出异常,返回null

返回值:

类型说明
VARCHAR sqlText的SQL语句中所有出现的表名,用逗号分隔

示例:

SELECT sql_export_tables(a.sql_text)
FROM (
SELECT ‘SELECT   s_acctbal, 
         s_name, 
         n_name, 
         p_partkey, 
         p_mfgr, 
         s_address, 
         s_phone, 
         s_comment 
FROM     part, 
         supplier, 
         partsupp, 
         nation, 
         region 
WHERE    p_partkey = ps_partkey 
AND      s_suppkey = ps_suppkey 
AND      p_size = 35 
AND      p_type LIKE ‘‘%NICKEL‘‘ 
AND      s_nationkey = n_nationkey 
AND      n_regionkey = r_regionkey 
AND      r_name = ‘‘MIDDLE EAST‘‘ 
AND      ps_supplycost IN 
         ( 
                SELECT min(ps_supplycost) 
                FROM   partsupp, 
                       supplier, 
                       nation, 
                       region 
                WHERE  s_suppkey = ps_suppkey 
                AND    s_nationkey = n_nationkey 
                AND    n_regionkey = r_regionkey 
                AND    r_name = ‘‘MIDDLE EAST‘‘ ) 
ORDER BY s_acctbal DESC, 
         n_name, 
         s_name, 
         p_partkey 
LIMIT    100;‘ AS sql_text
) a;

+--------------------------------------+
| sql_export_tables(a.sql_text)        |
+--------------------------------------+
| part,supplier,partsupp,nation,region |
+--------------------------------------+
技术图片技术图片

2.7 sql_format

函数调用形式:

  • sql_format(sqlText)
  • sql_format(sqlText, dbType)
  • sql_format(sqlText, dbType, throwError)

参数说明:

参数名类型说明
sqlText VARCHAR 必选
dbType VARCHAR 可选。SQL方言,默认为mysql
throwError BOOLEAN 可选。true时,遇到非法SQL抛出异常;false时,遇到非法SQL不抛出异常,返回null

返回值:

类型说明
VARCHAR 格式化sqlText的SQL语句

示例:

SELECT sql_format(a.sql_text)
FROM (
SELECT ‘SELECT   s_acctbal, 
         s_name, 
         n_name, 
         p_partkey, 
         p_mfgr, 
         s_address, 
         s_phone, 
         s_comment 
FROM     part, 
         supplier, 
         partsupp, 
         nation, 
         region 
WHERE    p_partkey = ps_partkey 
AND      s_suppkey = ps_suppkey 
AND      p_size = 35 
AND      p_type LIKE ‘‘%NICKEL‘‘ 
AND      s_nationkey = n_nationkey 
AND      n_regionkey = r_regionkey 
AND      r_name = ‘‘MIDDLE EAST‘‘ 
AND      ps_supplycost IN 
         ( 
                SELECT min(ps_supplycost) 
                FROM   partsupp, 
                       supplier, 
                       nation, 
                       region 
                WHERE  s_suppkey = ps_suppkey 
                AND    s_nationkey = n_nationkey 
                AND    n_regionkey = r_regionkey 
                AND    r_name = ‘‘MIDDLE EAST‘‘ ) 
ORDER BY s_acctbal DESC, 
         n_name, 
         s_name, 
         p_partkey 
LIMIT    100;‘ AS sql_text
) a;

+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| sql_format(a.sql_text)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| SELECT s_acctbal, s_name, n_name, p_partkey, p_mfgr
    , s_address, s_phone, s_comment
FROM part, supplier, partsupp, nation, region
WHERE p_partkey = ps_partkey
    AND s_suppkey = ps_suppkey
    AND p_size = 35
    AND p_type LIKE ‘%NICKEL‘
    AND s_nationkey = n_nationkey
    AND n_regionkey = r_regionkey
    AND r_name = ‘MIDDLE EAST‘
    AND ps_supplycost IN (
        SELECT min(ps_supplycost)
        FROM partsupp, supplier, nation, region
        WHERE s_suppkey = ps_suppkey
            AND s_nationkey = n_nationkey
            AND n_regionkey = r_regionkey
            AND r_name = ‘MIDDLE EAST‘
    )
ORDER BY s_acctbal DESC, n_name, s_name, p_partkey
LIMIT 100; |
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
技术图片技术图片

2.8 sql_params

函数调用形式:

  • sql_params(sqlText)
  • sql_params(sqlText, dbType)
  • sql_params(sqlText, dbType, throwError)

参数说明:

参数名类型说明
sqlText VARCHAR 必选
dbType VARCHAR 可选。SQL方言,默认为mysql
throwError BOOLEAN 可选。true时,遇到非法SQL抛出异常;false时,遇到非法SQL不抛出异常,返回null

返回值:

类型说明
VARCHAR 提取sqlText的SQL语句中的literal值

示例:

SELECT sql_params(a.sql_text)
FROM (
SELECT ‘SELECT   s_acctbal, 
         s_name, 
         n_name, 
         p_partkey, 
         p_mfgr, 
         s_address, 
         s_phone, 
         s_comment 
FROM     part, 
         supplier, 
         partsupp, 
         nation, 
         region 
WHERE    p_partkey = ps_partkey 
AND      s_suppkey = ps_suppkey 
AND      p_size = 35 
AND      p_type LIKE ‘‘%NICKEL‘‘ 
AND      s_nationkey = n_nationkey 
AND      n_regionkey = r_regionkey 
AND      r_name = ‘‘MIDDLE EAST‘‘ 
AND      ps_supplycost IN 
         ( 
                SELECT min(ps_supplycost) 
                FROM   partsupp, 
                       supplier, 
                       nation, 
                       region 
                WHERE  s_suppkey = ps_suppkey 
                AND    s_nationkey = n_nationkey 
                AND    n_regionkey = r_regionkey 
                AND    r_name = ‘‘MIDDLE EAST‘‘ ) 
ORDER BY s_acctbal DESC, 
         n_name, 
         s_name, 
         p_partkey 
LIMIT    100;‘ AS sql_text
) a;

+------------------------------------------------+
| sql_params(a.sql_text)                         |
+------------------------------------------------+
| [35,"%NICKEL","MIDDLE EAST","MIDDLE EAST",100] |
+------------------------------------------------+
技术图片技术图片

2.10 sql_pattern

函数调用形式:

  • sql_pattern(sqlText)
  • sql_pattern(sqlText, dbType)
  • sql_pattern(sqlText, dbType, throwError)

参数说明:

参数名类型说明
sqlText VARCHAR 必选
dbType VARCHAR 可选。SQL方言,默认为mysql
throwError BOOLEAN 可选。true时,遇到非法SQL抛出异常;false时,遇到非法SQL不抛出异常,返回null

返回值:

类型说明
VARCHAR 提取sqlText的SQL语句参数化后的SQL pattern, literal值换成?

示例:

SELECT sql_pattern(a.sql_text)
FROM (
SELECT ‘SELECT   s_acctbal, 
         s_name, 
         n_name, 
         p_partkey, 
         p_mfgr, 
         s_address, 
         s_phone, 
         s_comment 
FROM     part, 
         supplier, 
         partsupp, 
         nation, 
         region 
WHERE    p_partkey = ps_partkey 
AND      s_suppkey = ps_suppkey 
AND      p_size = 35 
AND      p_type LIKE ‘‘%NICKEL‘‘ 
AND      s_nationkey = n_nationkey 
AND      n_regionkey = r_regionkey 
AND      r_name = ‘‘MIDDLE EAST‘‘ 
AND      ps_supplycost IN 
         ( 
                SELECT min(ps_supplycost) 
                FROM   partsupp, 
                       supplier, 
                       nation, 
                       region 
                WHERE  s_suppkey = ps_suppkey 
                AND    s_nationkey = n_nationkey 
                AND    n_regionkey = r_regionkey 
                AND    r_name = ‘‘MIDDLE EAST‘‘ ) 
ORDER BY s_acctbal DESC, 
         n_name, 
         s_name, 
         p_partkey 
LIMIT    100;‘ AS sql_text
) a;

+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| sql_pattern(a.sql_text)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| SELECT s_acctbal, s_name, n_name, p_partkey, p_mfgr
    , s_address, s_phone, s_comment
FROM part, supplier, partsupp, nation, region
WHERE p_partkey = ps_partkey
    AND s_suppkey = ps_suppkey
    AND p_size = ?
    AND p_type LIKE ?
    AND s_nationkey = n_nationkey
    AND n_regionkey = r_regionkey
    AND r_name = ?
    AND ps_supplycost IN (
        SELECT min(ps_supplycost)
        FROM partsupp, supplier, nation, region
        WHERE s_suppkey = ps_suppkey
            AND s_nationkey = n_nationkey
            AND n_regionkey = r_regionkey
            AND r_name = ?
    )
ORDER BY s_acctbal DESC, n_name, s_name, p_partkey
LIMIT ?; |
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
技术图片技术图片

2.11 sql_pattern_hash

函数调用形式:

  • sql_pattern_hash(sqlText)
  • sql_pattern_hash(sqlText, dbType)
  • sql_pattern_hash(sqlText, dbType, throwError)

参数说明:

参数名类型说明
sqlText VARCHAR 必选
dbType VARCHAR 可选。SQL方言,默认为mysql
throwError BOOLEAN 可选。true时,遇到非法SQL抛出异常;false时,遇到非法SQL不抛出异常,返回null

返回值:

类型说明
VARCHAR 提取sqlText的SQL语句参数化后的SQL pattern,并生成hash值

示例:

SELECT sql_pattern_hash(a.sql_text)
FROM (
SELECT ‘SELECT   s_acctbal, 
         s_name, 
         n_name, 
         p_partkey, 
         p_mfgr, 
         s_address, 
         s_phone, 
         s_comment 
FROM     part, 
         supplier, 
         partsupp, 
         nation, 
         region 
WHERE    p_partkey = ps_partkey 
AND      s_suppkey = ps_suppkey 
AND      p_size = 35 
AND      p_type LIKE ‘‘%NICKEL‘‘ 
AND      s_nationkey = n_nationkey 
AND      n_regionkey = r_regionkey 
AND      r_name = ‘‘MIDDLE EAST‘‘ 
AND      ps_supplycost IN 
         ( 
                SELECT min(ps_supplycost) 
                FROM   partsupp, 
                       supplier, 
                       nation, 
                       region 
                WHERE  s_suppkey = ps_suppkey 
                AND    s_nationkey = n_nationkey 
                AND    n_regionkey = r_regionkey 
                AND    r_name = ‘‘MIDDLE EAST‘‘ ) 
ORDER BY s_acctbal DESC, 
         n_name, 
         s_name, 
         p_partkey 
LIMIT    100;‘ AS sql_text
) a;

+------------------------------+
| sql_pattern_hash(a.sql_text) |
+------------------------------+
|           925870115679910184 |
+------------------------------+
技术图片技术图片

2.12 sql_syntax_check

函数调用形式:

  • sql_syntax_check(sqlText)
  • sql_syntax_check(sqlText, dbType)
  • sql_syntax_check(sqlText, dbType, throwError)

参数说明:

参数名类型说明
sqlText VARCHAR 必选
dbType VARCHAR 可选。SQL方言,默认为mysql
throwError BOOLEAN 可选。true时,遇到非法SQL抛出异常;false时,遇到非法SQL不抛出异常,返回null

返回值:

类型说明
BOOLEAN 对sqlText进行语法检查,1表示正确,0表示错误

示例:

SELECT sql_syntax_check(a.sql_text)
FROM (
SELECT ‘SELECT   s_acctbal, 
         s_name, 
         n_name, 
         p_partkey, 
         p_mfgr, 
         s_address, 
         s_phone, 
         s_comment 
FROM     part, 
         supplier, 
         partsupp, 
         nation, 
         region 
WHERE    p_partkey = ps_partkey 
AND      s_suppkey = ps_suppkey 
AND      p_size = 35 
AND      p_type LIKE ‘‘%NICKEL‘‘ 
AND      s_nationkey = n_nationkey 
AND      n_regionkey = r_regionkey 
AND      r_name = ‘‘MIDDLE EAST‘‘ 
AND      ps_supplycost IN 
         ( 
                SELECT min(ps_supplycost) 
                FROM   partsupp, 
                       supplier, 
                       nation, 
                       region 
                WHERE  s_suppkey = ps_suppkey 
                AND    s_nationkey = n_nationkey 
                AND    n_regionkey = r_regionkey 
                AND    r_name = ‘‘MIDDLE EAST‘‘ ) 
ORDER BY s_acctbal DESC, 
         n_name, 
         s_name, 
         p_partkey 
LIMIT    100;‘ AS sql_text
) a;

+------------------------------+
| sql_syntax_check(a.sql_text) |
+------------------------------+
|                            1 |
+------------------------------+
技术图片技术图片

 



本文作者:julian.zhou

原文链接

本文为云栖社区原创内容,未经允许不得转载。

以上是关于DLA SQL分析函数:SQL语句审计与分析的利器的主要内容,如果未能解决你的问题,请参考以下文章

DRDS SQL 审计与分析——全面洞察 SQL 之利器

DRDS SQL 审计与分析——全面洞察 SQL 之利器

数据库全量SQL分析与审计系统性能优化之旅

Oracle SQL 性能优化利器

什么是数据库安全审计

ZZCMS201910代码审计