fixed issue with sql injection

chernser · chernser · commit 3c8b1fc6d5a9 · 2026-04-22T14:47:10.000-07:00
diff --git a/jdbc-v2/src/main/java/com/clickhouse/jdbc/StatementImpl.java b/jdbc-v2/src/main/java/com/clickhouse/jdbc/StatementImpl.java
@@ -334,7 +334,7 @@ public void cancel() throws SQLException {
         }
 
         try (QueryResponse response = connection.getClient().query(String.format("KILL QUERY%sWHERE query_id = '%s'",
-                connection.onCluster ? " ON CLUSTER '" + connection.cluster + "' " : " ",
+                connection.onCluster ? " ON CLUSTER `" + connection.cluster + "` " : " ",
                 lastQueryId), connection.getDefaultQuerySettings()).get()){
             LOG.debug("Query {} was killed by {}", lastQueryId, response.getQueryId());
         } catch (Exception e) {

Original file line number	Diff line number	Diff line change
`@@ -334,7 +334,7 @@ public void cancel() throws SQLException {`
`334`	`334`	`}`
`335`	`335`
`336`	`336`	`try (QueryResponse response = connection.getClient().query(String.format("KILL QUERY%sWHERE query_id = '%s'",`
`337`		`- connection.onCluster ? " ON CLUSTER '" + connection.cluster + "' " : " ",`
	`337`	+ connection.onCluster ? " ON CLUSTER `" + connection.cluster + "` " : " ",
`338`	`338`	`lastQueryId), connection.getDefaultQuerySettings()).get()){`
`339`	`339`	`LOG.debug("Query {} was killed by {}", lastQueryId, response.getQueryId());`
`340`	`340`	`} catch (Exception e) {`