What are potential pitfalls when trying to extract SQL statements from a string that may contain comments or other code?

When trying to extract SQL statements from a string that may contain comments or other code, a potential pitfall is mistakenly including commented-out SQL statements or other non-SQL code in the extraction. To solve this, you can use a regular expression to match and extract only valid SQL statements that are not commented out. 

// Sample string that may contain SQL statements with comments
$string = "SELECT * FROM table1; -- This is a comment
           /* This is a multi-line comment */
           INSERT INTO table2 VALUES (1, 'example');";

// Regular expression to extract SQL statements excluding comments
preg_match_all('/\b(SELECT|INSERT|UPDATE|DELETE|CREATE|ALTER|DROP)\b[^;]*;/i', $string, $matches);

// Extracted SQL statements
$sqlStatements = $matches[0];

// Output the extracted SQL statements
foreach ($sqlStatements as $sql) {
    echo $sql . PHP_EOL;
}

Keywords

SQL injection regular expressions comment removal parsing security vulnerabilities

Related Questions