Database statement checking method, system, device and electronic equipment

Abstract

The present invention discloses a database statement inspection method, system, device, and electronic device. The method comprises: obtaining a database statement to be inspected; determining a query scenario corresponding to the database statement; determining a strategy tree corresponding to the query scenario, wherein the strategy tree represents the inspection logic for inspecting the database statement; and performing a string inspection on the database statement based on the strategy tree to obtain a first inspection result. The present invention solves the technical problem of low inspection precision caused by the use of a unified inspection rule to inspect database statements in different scenarios in the prior art.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a method, system, device and electronic equipment for checking database statements. Background Art

[0002] Based on the category of application business scenarios, the execution conditions of database statements, etc., the access to the database in an application system can be subdivided into several query scenarios, such as online transaction scenarios, batch job scenarios, summary statistics scenarios, version production scenarios, system operation and maintenance scenarios, etc.

[0003] In various query scenarios, when database statements (such as SQL, etc.) access the database, they need to be checked to ensure that the database statements meet the requirements of the query scenario.

[0004] However, in existing technologies, to accommodate various query scenarios, relevant checking systems often use the maximum value of each scenario's check threshold as a unified rule. For example, database statement execution time is considered slow if it takes longer than 0.5 seconds in online transaction scenarios, and slower if it takes longer than 10 seconds in batch job scenarios. To support both online transaction and batch job scenarios, the slow database statement check threshold must be set to 10 seconds. This results in overly lax checks for database statements in online transaction scenarios, which in turn renders the checks ineffective.

[0005] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0006] Embodiments of the present invention provide a database statement checking method, system, device, and electronic device to at least solve the technical problem of low checking precision caused by using unified checking rules to check database statements in different scenarios in the prior art.

[0007] According to one aspect of an embodiment of the present invention, a method for checking database statements is provided, comprising: obtaining a database statement to be checked; determining a query scenario corresponding to the database statement; determining a strategy tree corresponding to the query scenario, wherein the strategy tree represents a check logic for checking the database statement; and performing a string check on the database statement based on the strategy tree to obtain a first check result.

[0008] Furthermore, the database statement checking method also includes: obtaining a first call instruction, wherein the first call instruction is an instruction sent by the target database before the database statement is input into the parser, the target database is the database processed by the database statement, and the parser is set in the target database; based on the first call instruction, obtaining the database statement.

[0009] Furthermore, the method for checking database statements also includes: determining the stage information corresponding to the database statement, wherein the stage information is used to characterize the processing status of the database statement processed by the database; determining at least one target rule unit from multiple rule units based on the strategy tree and the stage information corresponding to the database statement, wherein the target rule unit is used to check the database statement; determining the combination logic based on the strategy tree; combining at least one target rule unit based on the combination logic to obtain a first target governance strategy; and performing a string check on the database statement based on the first target governance strategy to obtain a first inspection result.

[0010] Furthermore, the database statement inspection method also includes: after performing a string inspection on the database statement based on the policy tree and obtaining a first inspection result, determining whether to trigger a first interception instruction based on the first inspection result and the scenario information table, wherein the scenario information table is at least used to characterize the conditions for triggering the interception instruction to intercept the target database; when it is determined that the first interception instruction is not triggered, controlling the target database to input the database statement into the parser; obtaining a parse tree, wherein the parse tree is obtained by the parser parsing the database statement; determining a second target governance strategy based on the policy tree, the stage information corresponding to the parse tree, and multiple rule units; and performing a structured inspection on the parse tree based on the second target governance strategy to obtain a second inspection result.

[0011] Furthermore, the database statement inspection method also includes: performing a structured inspection on the parse tree based on the second target governance strategy, and after obtaining a second inspection result, determining whether to trigger a second interception instruction based on the second inspection result and the scenario information table; if it is determined that the second interception instruction is not triggered, controlling the target database to process the parse tree to obtain a target parse tree; determining a third target governance strategy based on the strategy tree, the stage information corresponding to the target parse tree, and multiple rule units; and performing a format check on the target parse tree based on the third target governance strategy to obtain a third inspection result.

[0012] Furthermore, the database statement inspection method also includes: based on the third target governance strategy, performing a format check on the target parse tree, after obtaining a third inspection result, determining whether to trigger a third interception instruction based on the third inspection result and the scenario information table; when it is determined that the third interception instruction is not triggered, controlling the target database to input the target parse tree into the optimizer, wherein the optimizer is set in the target database; obtaining a target execution plan, wherein the target execution plan is obtained by optimizing the target parse tree by the optimizer; determining a fourth target governance strategy based on the strategy tree, the first stage information corresponding to the target execution plan, and multiple rule units; based on the fourth target governance strategy, performing an index field check on the target execution plan to obtain a fourth inspection result.

[0013] Furthermore, the database statement checking method also includes: based on the fourth target governance strategy, performing an index field check on the target execution plan, after obtaining the fourth check result, determining whether to trigger the fourth interception instruction based on the fourth check result and the scenario information table; when it is determined that the fourth interception instruction is not triggered and the target execution plan meets the preset conditions, controlling the target database to input the target execution plan into the executor, wherein the executor is set in the target database.

[0014] Furthermore, the database statement checking method also includes: when it is determined that the fourth interception instruction is not triggered, determining the fifth target governance strategy based on the strategy tree, the second stage information corresponding to the target execution plan, and multiple rule units; based on the fifth target governance strategy, checking whether the target execution plan meets the execution conditions to obtain a fifth inspection result; based on the fifth inspection result and the scenario information table, determining whether the fifth interception instruction is triggered; when it is determined that the fifth interception instruction is not triggered, determining that the target execution plan meets the preset conditions, and controlling the target database to input the target execution plan into the executor.

[0015] Furthermore, the database statement inspection method also includes: after controlling the target database to input the target execution plan into the executor, obtaining the execution result, wherein the execution result is obtained by the executor executing the target execution plan; determining the sixth target governance strategy based on the strategy tree, the stage information corresponding to the execution result, and multiple rule units; based on the sixth target governance strategy, checking whether the execution result meets the target condition to obtain a sixth inspection result.

[0016] Furthermore, the database statement checking method also includes: determining whether the sixth interception instruction is triggered based on the sixth check result and the scenario information table; when it is determined that the sixth interception instruction is not triggered, controlling the target database to send the query result in the execution result to the terminal device, wherein the query result corresponds to the database statement.

[0017] According to another aspect of an embodiment of the present invention, a database statement inspection system is also provided, including: a target database, used to obtain database statements and process the database statements to determine the query results corresponding to the database statements; a governance system, the governance system is loaded in the process space of the target database, and is used to determine the query scenario corresponding to the database statement before the target database processes the database statement, and determine the strategy tree corresponding to the query scenario, so as to perform a string check on the database statement based on the strategy tree to obtain the inspection result, and determine whether to trigger an interception instruction based on the inspection result, wherein the interception instruction is used to intercept the target database from processing the database statement.

[0018] Furthermore, the target database includes: a parser, an optimizer and an executor; the parser, the input end of the parser is provided with a text check interface, the output end of the parser is provided with a parse tree check interface, and the parser is used to parse the database statement to obtain a parse tree; the optimizer, the input end of the optimizer is provided with a preprocessing check interface, the output end of the optimizer is provided with an index matching interface, the optimizer is used to optimize the target parse tree to obtain a target execution plan, wherein the target parse tree corresponds to the parse tree; the executor, the input end of the executor is provided with an execution plan check interface, the output end of the executor is provided with an execution result check interface, the executor is used to execute the target execution plan to obtain an execution result, and the execution result at least includes a query result; the text check interface, the parse tree check interface, the preprocessing check interface, the index matching interface, the execution plan check interface and the execution result check interface are connected to the governance system.

[0019] According to another aspect of an embodiment of the present invention, a database statement inspection device is also provided, including an acquisition module for acquiring a database statement to be inspected; a first determination module for determining a query scenario corresponding to the database statement; a second determination module for determining a strategy tree corresponding to the query scenario, wherein the strategy tree represents an inspection logic for inspecting the database statement; and an inspection module for performing a string inspection on the database statement based on the strategy tree to obtain a first inspection result.

[0020] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is configured to execute the above-mentioned database statement checking method when running.

[0021] According to another aspect of an embodiment of the present invention, an electronic device is also provided, which includes one or more processors; a memory for storing one or more programs, which, when the one or more programs are executed by the one or more processors, enables the one or more processors to implement the method for running the programs, wherein the programs are configured to execute the above-mentioned database statement checking method at runtime.

[0022] In an embodiment of the present invention, different checking rules are used to check database statements in different scenarios. By obtaining a database statement to be checked, determining the query scenario corresponding to the database statement, and then determining a policy tree corresponding to the query scenario, a string check is performed on the database statement based on the policy tree to obtain a first check result. The policy tree represents the check logic for checking the database statement.

[0023] In the above process, by determining the query scenario corresponding to the database statement and checking the database statement based on the inspection logic corresponding to the determined query scenario, different inspections of database statements under different query scenarios are achieved, avoiding the existing technology of using a unified inspection rule for all database statements on a database instance, that is, the inability to distinguish query scenarios and implement different inspection rules according to the query scenarios, thereby improving the inspection precision and further improving the inspection effect.

[0024] It can be seen that the solution provided by the present application achieves the purpose of using different inspection rules to check database statements in different scenarios, thereby achieving the technical effect of improving the inspection precision, and further solving the technical problem of low inspection precision caused by using unified inspection rules to check database statements in different scenarios in the existing technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0026] Figure 1 is a schematic diagram of an optional database statement checking method according to an embodiment of the present invention;

[0027] Figure 2 is a schematic diagram of an optional target database and governance system according to an embodiment of the present invention;

[0028] Figure 3 is a schematic diagram of an optional database statement checking device according to an embodiment of the present invention;

[0029] Figure 4 is a schematic diagram of an optional electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display and analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set up between this system and the relevant user or organization. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain the relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0033] Example 1

[0034] According to an embodiment of the present invention, an embodiment of a method for checking database statements is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0035] Figure 1 is a schematic diagram of an optional database statement checking method according to an embodiment of the present invention, such as Figure 1 As shown, the method includes the following steps:

[0036] Step S101: Obtain a database statement to be checked.

[0037] In step S101, the database statement can be obtained through electronic devices, processors, application systems and other devices. In this embodiment, the database statement to be checked is obtained through the management system. Figure 2 As shown, the database statements to be checked are database statements sent by a database user or a database user through an application to the target database. These database statements enter the database kernel through a connector in the target database and can be retrieved from the database kernel by the governance system. Optionally, the database statements are statements used when using the database, and can be SQL (Structured Query Language) statements or other statements.

[0038] Step S102: Determine the query scenario corresponding to the database statement.

[0039] In step S102, the governance system may determine the query scenario corresponding to the database statement based on the identifier corresponding to the database user or application that initiated the database statement, or based on the format and content of the database statement, or in other ways. The query scenario, also known as the application scenario, represents the scenario in which the database statement is applied. For example, the query scenario may be a scenario for querying identity information, querying transaction data, or querying work files.

[0040] It should be noted that by determining the query scenario corresponding to the database statement, it is convenient to subsequently determine the check logic corresponding to the database statement.

[0041] Step S103: determining a strategy tree corresponding to the query scenario, wherein the strategy tree represents the checking logic for checking the database statement.

[0042] Optionally, before determining the policy tree corresponding to the query scenario, relevant staff may develop check logic information for checking database statements in at least one query scenario. Preferably, check logic information for checking database statements in each possible query scenario may be developed. The check logic information developed by the relevant staff may be processed by a relevant processing module to obtain a policy tree that can be recognized by the governance system or other systems. Each piece of check logic information may be stored in the governance system, the target database, or other storage area, preferably in the governance system. It should be noted that the corresponding relationship between the check logic information and the query scenario is also stored along with the check logic information.

[0043] Optionally, before determining the strategy tree corresponding to the query scenario, relevant personnel may directly develop at least one strategy tree corresponding to the query scenario and store each strategy tree in the governance system, target database, or other storage area, preferably in the governance system. It should be noted that the corresponding relationship between the strategy tree and the query scenario is also stored along with the strategy tree.

[0044] Furthermore, the governance system can determine the policy tree corresponding to the aforementioned query scenario based on the correspondence between the inspection logic information and the query scenario, the correspondence between the policy tree and the inspection logic information, or the correspondence between the policy tree and the query scenario.

[0045] It should be noted that by determining the checking logic for checking database statements in different query scenarios, it is possible to perform targeted checks on the database statements subsequently.

[0046] Step S104: Based on the strategy tree, perform a character string check on the database statement to obtain a first check result.

[0047] In step 104, the governance system can determine, based on the policy tree, the corresponding rule units for checking the database statement and the combination logic between the rule units. The system then performs a string check on the database statement based on the rule units combined using the combination logic, obtaining a first check result. The first check result indicates whether there are any problems with the string of the database statement.

[0048] It should be noted that by using the inspection logic corresponding to the query scenario of the database statement to check the database statement, the problem of low inspection precision caused by the use of a unified inspection rule for all database statements on the database instance in the existing technology is avoided, that is, the query scenario cannot be distinguished and different inspection rules are implemented according to the query scenario. This realizes differentiated inspections of database statements in different scenarios, thereby improving the inspection precision and further improving the inspection effect.

[0049] Based on the solution defined in steps S101 to S104 above, it can be seen that in this embodiment of the present invention, different check rules are used to check database statements in different scenarios. By obtaining a database statement to be checked, determining the query scenario corresponding to the database statement, and then determining a policy tree corresponding to the query scenario, a string check is performed on the database statement based on the policy tree to obtain a first check result. The policy tree represents the check logic for checking the database statement.

[0050] It is easy to notice that in the above process, by determining the query scenario corresponding to the database statement and checking the database statement based on the inspection logic corresponding to the determined query scenario, it is achieved that the database statements in different query scenarios have different inspections, avoiding the existing technology of using a unified inspection rule for all database statements on the database instance, that is, it is impossible to distinguish the query scenarios and implement different inspection rules according to the query scenarios, thereby improving the inspection precision and further improving the inspection effect.

[0051] It can be seen that the solution provided by the present application achieves the purpose of using different inspection rules to check database statements in different scenarios, thereby achieving the technical effect of improving the inspection precision, and further solving the technical problem of low inspection precision caused by using unified inspection rules to check database statements in different scenarios in the existing technology.

[0052] In an optional embodiment, as Figure 2 As shown, before the user or application enters the database statement into the target database, the relevant staff can configure the scenario information table in the governance system (i.e. Figure 2 In the SQL application scenario information table), the query scenario corresponds to the scenario information table. Specifically, in this embodiment, the method provided by this application is described by taking SQL statements as an example.

[0053] Alternatively, relevant staff can use standard SQL INSERT statements to enter the SQL query scenario name, scenario description, database user name, and the SQL governance policy corresponding to the scenario into the scenario information table, where the SQL governance policy is the aforementioned check logic information. An optional scenario information table is as follows:

[0054] INSERT INTO sys.scenorio(name,desc,users,strategy)VALUES(

[0055] "oltp", --scene name

[0056] "Online transaction scenario", -- scenario description

[0057] "app_abc1,app_abc2,app_abc3",--Database users for this scenario

[0058] " --The following is the SQL governance strategy for this scenario

[0059] IF:

[0060] executiontime>500ms||

[0061] (CPUusage>60)&&(executiontime>100ms)||

[0062] undoentry>300||

[0063] noIndex==true||

[0064] resultrows>3000||

[0065] ......(omitted because it's too long)......

[0066] THEN: warning -- the triggered action is warning

[0067] IF:

[0068] isTuncate==true||

[0069] isDropTable==true||

[0070] isDropDatabase == true||

[0071] ......(omitted because it's too long)......

[0072] THEN:intercept --The triggered action is to intercept SQL execution

[0073] ");

[0074] As shown above, SQL governance policies are composed of SQL check rules using logical combinations such as AND, OR, NOT, conditionals, and nested statements, and include post-trigger actions. A SQL governance policy corresponds to the overall requirements for SQL statements in a specific SQL query scenario, including static requirements for SQL statement writing and dynamic requirements for SQL statement execution. Optionally, information related to SQL application scenarios can be stored using external configuration files or system configuration parameters.

[0075] In this embodiment, the present application is applied to a database in a financial system. The query scenarios corresponding to this database include, but are not limited to, online transaction scenarios, batch job scenarios, online small batch scenarios, query platform scenarios, version production scenarios, and system operation and maintenance scenarios. Batch job scenarios refer to scenarios corresponding to operations such as end-of-day closing, quarter-end settlement, batch derivatives, and batch updates. Online small batch scenarios refer to small batch jobs executed within a non-fixed time window, such as updating the balances of hundreds of employees in a unit. Query platform scenarios refer to scenarios corresponding to read-only data query services, commonly found in query platform applications. Version production scenarios refer to scenarios corresponding to database object version production operations, i.e., executing DDL to update database object definitions, typically performed by production environment application support personnel. System operation and maintenance scenarios refer to scenarios corresponding to daily database system operation and maintenance management, typically performed by production environment system operation and maintenance personnel. On this basis, new SQL query scenarios can also be easily customized using standard SQL statements. Optionally, the present application can also be applied to databases in Internet systems, databases in medical systems, and the like.

[0076] Furthermore, if Figure 2 As shown, the governance system also includes an SQL governance function module. After configuring the aforementioned scenario information table, it is necessary to load the SQL governance function module sqlgovern.so in the target database. Optionally, the SQL governance function module can be automatically loaded when the target database is started, or it can be manually loaded during the operation of the target database. The SQL governance function module is compiled into a shared link library sqlgovern.so using gcc--share technology, and the SQL governance function module sqlgovern.so is dynamically loaded into the database process space by using a dynamic linker, so that the database kernel can call the various check modules in the SQL governance function module in the SQL execution processing flow. Among them, the database kernel can call the various check modules in the SQL governance function module through a set of SQL governance interface points preset in the database kernel.

[0077] Furthermore, if Figure 2 As shown, the SQL governance function module also includes a SQL application scenario engine, which includes an initialization module. The initialization module can read the relevant information of each query scenario in the scenario information table and generate a policy tree corresponding to each SQL query scenario based on the SQL governance policy corresponding to the scenario for subsequent use.

[0078] In an optional embodiment, after the configuration, loading, and initialization of the governance system are complete, the governance system can obtain a first call instruction during the database processing of a database statement, and based on the first call instruction, obtain the database statement. The first call instruction is an instruction sent by the target database before the database statement is input into the parser. The target database is the database processed by the database statement, and the parser is located in the target database.

[0079] Optional, such as Figure 2 As shown, Figure 2 Reference numeral 1 in the figure represents the text check interface. Before a database statement enters the parser in the database kernel, the target database can invoke the text check module in the SQL management function module through the text check interface pre-set in the database kernel, passing the user connection processing thread THD to which the SQL statement belongs as a parameter. The SQL management function module can obtain the management data structure of the user connection, the management data structure of the current transaction on the user connection, and the management data structure of the current SQL statement on the user connection through TH, thereby obtaining the database statement to be checked and its related information.

[0080] It should be noted that by obtaining the database statement for inspection before the database statement enters the parser in the database kernel, the inspection process for the database statement is enriched and the inspection effect is improved.

[0081] In an optional embodiment, when performing a string check on a database statement based on a policy tree to obtain a first check result, the governance system may determine the stage information corresponding to the database statement, and then determine at least one target rule unit from multiple rule units based on the policy tree and the stage information corresponding to the database statement. Then, based on the policy tree, it determines combination logic, and combines the at least one target rule unit based on the combination logic to obtain a first target governance policy, thereby performing a string check on the database statement based on the first target governance policy to obtain a first check result. The stage information is used to represent the processing status of the database statement by the database, and the target rule unit is used to check the database statement.

[0082] Optionally, after the text inspection module in the SQL governance function module obtains the database statement to be checked, the text inspection module can call the application scenario engine in the governance system, and the engine driving module in the application scenario engine determines the user to whom the current SQL statement belongs, and determines the query scenario corresponding to the SQL statement based on the user identifier, thereby determining the strategy tree corresponding to the query scenario.

[0083] Afterwards, the engine driver module can also determine the stage information corresponding to the database statement, that is, determine the processing progress of the database statement in the target database. For example, at the current moment, the stage information can indicate that the processing progress of the database statement at this time is before entering the parser. Therefore, the engine driver module can determine at least one target rule unit from multiple rule units based on the stage information. Each rule unit corresponds to a SQL check rule in the SQL governance policy corresponding to the policy tree, such as Figure 2 The where condition rule unit, COST overhead rule unit, lock waiting rule unit, execution time rule unit, etc.

[0084] Furthermore, the engine driver module can determine the combination logic between the target rule units based on the policy tree, and combine at least one target rule unit based on the combination logic to obtain a first target governance policy. The combination logic can be AND, OR, NOT, conditional, nested, or other combination logic. The first target governance policy is a portion of the SQL governance policy corresponding to the policy tree.

[0085] Furthermore, the engine driver module can call the relevant target rule unit based on the first target governance policy to perform string checks on the SQL statement, thereby obtaining a first check result. String checks include, but are not limited to, checking for DELETE statements without a where condition, checking for unspecified column names in SELECT statements, and executing DDL statements in online transaction scenarios.

[0086] It should be noted that by determining the first target governance strategy based on the strategy tree and the stage information corresponding to the database statement, the governance strategy and rule units corresponding to the target database in different stages of processing database statements are determined, thereby facilitating improving the accuracy of database statement checking.

[0087] In an optional embodiment, after performing a string check on the database statement based on the policy tree and obtaining a first check result, the governance system can determine whether to trigger the first interception instruction based on the first check result and the scenario information table, and if it is determined that the first interception instruction is not triggered, control the target database to input the database statement into the parser, and then obtain the parse tree, and determine the second target governance policy based on the policy tree, the stage information corresponding to the parse tree, and multiple rule units, so as to perform a structured check on the parse tree based on the second target governance policy and obtain a second check result. Among them, the scenario information table is used to at least characterize the conditions for triggering the interception instruction to intercept the target database, and the parse tree is obtained by the parser parsing the database statement.

[0088] The conditions that trigger the interception instruction for intercepting the target database refer to the aforementioned disposal measures. These disposal measures can be set in the SQL governance policy in the scenario information table, or they can be set in the scenario information table independently of the SQL governance policy. In this embodiment, the disposal measures are preferably set in the SQL governance policy in the scenario information table, that is, the policy tree also represents the disposal logic for handling database statements. It should be emphasized that in preferred embodiments, the aforementioned target rule unit also includes the rule unit corresponding to the corresponding disposal measure.

[0089] Optionally, in a preferred embodiment, the application scenario engine can determine whether to trigger corresponding disposal measures based on the first inspection result and the first target governance policy determined based on the SQL governance policy in the scenario information table. Specifically, Figure 2 As shown, when a disposal measure is triggered, if the triggered disposal measure is an alarm, the alarm unit in the processing module of the governance system can be called, and the alarm unit outputs the information required for SQL problem diagnosis to the SQL governance recording device in the governance system. The information includes but is not limited to the SQL statement text, SQL statement execution plan, detailed time of each step of SQL statement execution, number of scanned rows, lock wait information, resource consumption information, and violated SQL check rules. After outputting the information, it returns normally to control the target database to continue the subsequent SQL statement execution process. If the triggered disposal measure is interception, that is, when the first interception instruction is triggered, the interception unit in the processing module of the governance system can be called, and the interception unit outputs the information required for SQL problem diagnosis to the SQL governance recording device, terminates the execution of the SQL statement in the target database, and returns the SQL exception error code. If the disposal measure is not triggered, it can directly return normally to control the target database to continue the subsequent SQL statement execution process, that is, control the target database to input the database statement into the parser.

[0090] Optionally, if the handling measures are set independently of the SQL governance policy in the scenario information table, the governance system can obtain the corresponding handling procedure or handling logic from the scenario information table, and directly determine whether to trigger the first interception instruction based on the handling procedure and the first inspection result, or based on the handling logic, in accordance with the same method as the method of determining the target rule unit and determining the first target governance policy, combine to obtain a handling governance policy, thereby determining whether to trigger the first interception instruction based on the handling governance policy and the first inspection result.

[0091] It should be noted that the aforementioned SQL governance recording device can record the processing results of the handling module within the SQL governance functional module in real time, including but not limited to timestamps, alert / interception handling status, and information related to SQL problem diagnosis and analysis. The SQL governance recording device can also periodically push SQL governance records for this database instance to the SQL governance management platform. The SQL governance management platform is used to manage SQL governance for multiple database instances, generate SQL problem remediation work orders, and track the SQL problem analysis and remediation process to achieve closed-loop SQL governance management.

[0092] Furthermore, when the SQL statement enters the parser in the target database, the parser can perform SQL lexical analysis, syntax analysis and semantic analysis, and generate an SQL parse tree. Figure 2 As shown, Figure 2 Reference numeral 2 in the figure represents the preprocessing check interface. After the SQL statement completes parser processing, the target database can invoke the parse tree check module in the SQL management function module through the parse tree check interface pre-set in the database kernel, passing the user connection processing thread THD to which the SQL statement belongs as a parameter. At this point, the parse tree check module in the SQL management function module can obtain the management data structure of the user connection, the management data structure of the current transaction on the user connection, the management data structure of the current SQL statement on the user connection, and the management data structure of the current SQL parse tree, thereby obtaining the parse tree and related information.

[0093] Furthermore, the parse tree inspection module can call the application scenario engine, and the engine driving module determines the second target governance strategy based on the aforementioned method for determining the first target governance strategy to implement a structural inspection of the SQL parse tree and obtain the second inspection result, so it will not be repeated here. Among them, the structural inspection includes but is not limited to the inspection of multi-table associations and multiple nested structures.

[0094] It should be noted that by controlling the target database to continue processing database statements even when the first interception instruction is not triggered, inspection and query efficiency are improved. Furthermore, the accuracy of database statement inspection is improved by determining the second target governance strategy based on the phase information corresponding to the policy tree and parse tree. Furthermore, by inspecting the parse tree output by the parser after the database statement enters the database kernel, the inspection process for database statements is enriched and inspection effectiveness is enhanced.

[0095] In an optional embodiment, after performing a structured check on the parse tree based on the second target governance strategy and obtaining a second inspection result, the governance system can determine whether to trigger the second interception instruction based on the second inspection result and the scenario information table, and if it is determined that the second interception instruction is not triggered, control the target database to process the parse tree to obtain a target parse tree, and then determine the third target governance strategy based on the strategy tree, the stage information corresponding to the target parse tree, and multiple rule units, so as to perform a format check on the target parse tree based on the third target governance strategy to obtain a third inspection result.

[0096] Optionally, the governance system can determine whether to trigger the second interception instruction based on the aforementioned method of determining whether to trigger the first interception instruction, and when the disposal measure is triggered, use the aforementioned method for processing the disposal measure to process this disposal measure, so it will not be repeated here.

[0097] Furthermore, if it is determined that the second interception instruction is not triggered, the governance system can control the target database to process the parse tree to obtain the target parse tree. The target database's processing methods for the parse tree include but are not limited to variable placeholder processing, equivalent rewriting processing, etc.

[0098] Furthermore, if Figure 2 As shown, Figure 2 Reference numeral 3 in the figure represents the preprocessing check interface. After obtaining the target parse tree, the target database can invoke the preprocessing check module in the SQL management function module through the preprocessing check interface pre-configured in the database kernel, passing the user connection processing thread THD to which the SQL statement belongs as a parameter. The preprocessing check module can use the THD to obtain the management data structure of the user connection, the management data structure of the current transaction on the user connection, the management data structure of the current SQL statement on the user connection, and the management data structure of the current SQL parse tree, thereby obtaining the target parse tree and related information.

[0099] Furthermore, the parse tree checking module can call the application scenario engine, and the engine driving module determines the third target governance strategy based on the aforementioned method for determining the first target governance strategy to implement format checking of the target parse tree and obtain the third inspection result, so it will not be repeated here. Among them, the format check includes but is not limited to the check of variable placeholders and the check of equivalent rewriting.

[0100] It should be noted that by controlling the target database to continue processing database statements even when the second interception instruction is not triggered, inspection and query efficiency are improved. Furthermore, determining the third target governance strategy based on the strategy tree and the corresponding phase information of the target parse tree improves the accuracy of database statement inspection. Furthermore, by processing the parse tree in the target database to obtain the target parse tree, and then inspecting the target parse tree, the inspection process for database statements is enriched and the inspection effect is improved.

[0101] In an optional embodiment, after performing a format check on the target parse tree based on the third target governance strategy and obtaining a third check result, the governance system can determine whether to trigger the third interception instruction based on the third check result and the scenario information table, and if it is determined that the third interception instruction is not triggered, control the target database to input the target parse tree into the optimizer, and then obtain the target execution plan, and determine the fourth target governance strategy based on the strategy tree, the first stage information corresponding to the target execution plan, and multiple rule units, so as to perform an index field check on the target execution plan based on the fourth target governance strategy to obtain a fourth check result. Wherein, the optimizer is set in the target database, and the target execution plan is obtained by the optimizer optimizing the target parse tree.

[0102] Optionally, the governance system can determine whether to trigger the third interception instruction based on the aforementioned method of determining whether to trigger the first interception instruction, and when the disposal measure is triggered, use the aforementioned method for processing the disposal measure to process this disposal measure, so it will not be repeated here.

[0103] Furthermore, when it is determined that the third interception instruction is not triggered, the governance system can control the target database to input the target parse tree into the optimizer, and the optimizer performs an optimization process on the target parse tree to generate a corresponding target execution plan.

[0104] Optional, such as Figure 2 As shown, Figure 2 Reference numeral 4 in the diagram represents the index match check interface. After the optimizer completes processing, the target database can invoke the index match check module in the SQL management function module through the index match check interface pre-set in the database kernel, passing the THD (user connection processing thread) to which the SQL statement belongs as a parameter. The index match check module can use the THD to obtain the management data structure of the user connection, the management data structure of the current transaction on the user connection, the management data structure of the current SQL statement on the user connection, the parse tree and target execution plan for the current SQL statement, thereby acquiring the target execution plan and related information.

[0105] Furthermore, the index matching check module can call the application scenario engine. The engine driver module, based on the aforementioned method for determining the first target governance strategy, determines a fourth target governance strategy to implement an index field check for the target execution plan and obtain a fourth check result. Therefore, we will not elaborate on this here. The index field check includes but is not limited to checking the index first field and checking the index matching field filter rate. At the current moment, the first-stage information is used to indicate the corresponding processing progress of the database statement after being output from the optimizer.

[0106] It should be noted that by controlling the target database to continue processing database statements even when the third interception instruction is not triggered, inspection and query efficiency are improved. Furthermore, by determining the fourth target governance strategy based on the first-stage information corresponding to the strategy tree and the target execution plan, the accuracy of database statement inspection is improved. Furthermore, by inspecting the execution plan output by the optimizer after the database statement is output from the database kernel, the inspection process for database statements is enriched and inspection effectiveness is enhanced.

[0107] In an optional embodiment, after performing an index field check on the target execution plan based on the fourth target governance strategy and obtaining the fourth check result, the governance system can determine whether to trigger the fourth interception instruction based on the fourth check result and the scenario information table, and when it is determined that the fourth interception instruction is not triggered and the target execution plan meets the preset conditions, control the target database to input the target execution plan into the executor, wherein the executor is set in the target database.

[0108] Optionally, the governance system can determine whether to trigger the fourth interception instruction based on the aforementioned method of determining whether to trigger the first interception instruction, and when the disposal measure is triggered, use the aforementioned method for processing the disposal measure to process this disposal measure, so it will not be repeated here.

[0109] Furthermore, if Figure 2 As shown, if it is determined that the fourth interception instruction has not been triggered and the target execution plan meets the preset conditions, the governance system can control the target database to input the target execution plan into the executor. The preset conditions can be time conditions, processing conditions, or other conditions.

[0110] It should be noted that by controlling the target database to continue processing the database statement when the fourth interception instruction is not triggered and the target execution plan meets the preset conditions, the inspection efficiency and the query efficiency are improved.

[0111] In an optional embodiment, when it is determined that the fourth interception instruction is not triggered and the target execution plan meets the preset conditions, in the process of controlling the target database to input the target execution plan into the executor, the governance system can determine the fifth target governance strategy based on the strategy tree, the second stage information corresponding to the target execution plan, and multiple rule units when it is determined that the fourth interception instruction is not triggered, and check whether the target execution plan meets the execution conditions based on the fifth target governance strategy to obtain the fifth check result, and then determine whether to trigger the fifth interception instruction based on the fifth check result and the scenario information table, so as to determine that the target execution plan meets the preset conditions when it is determined that the fifth interception instruction is not triggered, and control the target database to input the target execution plan into the executor.

[0112] Optionally, when it is determined that the fourth interception instruction is not triggered, Figure 2 As shown, Figure 2 Reference numeral 5 in the figure represents the execution plan check interface. The target database can use this interface, pre-configured within the database kernel, to call the execution plan check module within the SQL governance module and pass the user connection processing thread (THD) to which the SQL statement belongs as a parameter. The execution plan check module can then retrieve the management data structure of the user connection, the management data structure of the current transaction on the user connection, the management data structure of the current SQL statement on the user connection, the parse tree of the current SQL statement, and the target execution plan from the THD to obtain the target execution plan.

[0113] Furthermore, the execution plan check module can call the application scenario engine, and the engine driving module determines the fifth target governance strategy based on the aforementioned method for determining the first target governance strategy to check whether the target execution plan meets the execution conditions and obtain the fifth check result, so it will not be repeated here. Among them, the execution condition check includes but is not limited to the SQL statement COST overhead estimation check and the estimated number of scan rows check.

[0114] Furthermore, the governance system can determine whether to trigger the fifth interception instruction based on the aforementioned method for determining whether to trigger the first interception instruction. If a remediation measure is triggered, the governance system can process the remediation measure using the aforementioned method for processing the remediation measure, which is not described here. At the current moment, the second-stage information is used to represent the processing progress of the database statement from before it entered the executor.

[0115] Furthermore, when it is determined that the fifth interception instruction has not been triggered, the governance system can control the target database to input the target execution plan into the executor, and the executor will perform the actual execution processing according to the target execution plan, access the storage engine and query the qualified data rows to obtain the execution results.

[0116] It should be noted that by controlling the target database to continue processing database statements even when the fifth interception instruction is not triggered, inspection and query efficiency are improved. Furthermore, by checking the execution plan before the database statement enters the executor in the database kernel, the database statement inspection process is enriched and inspection effectiveness is improved.

[0117] In an optional embodiment, after the control target database inputs the target execution plan into the executor, the governance system can obtain the execution result and, based on the policy tree, the stage information corresponding to the execution result, and the multiple rule units, determine a sixth target governance policy. Based on the sixth target governance policy, the governance system then checks whether the execution result meets the target conditions, thereby obtaining a sixth check result. The execution result is obtained by the executor executing the target execution plan.

[0118] Optional, such as Figure 2 As shown, Figure 2 Reference numeral 6 in the figure represents the execution result check interface. After the SQL statement completes execution by the executor, the target database can invoke the execution result check module in the SQL governance function module through the execution result check interface pre-set in the database kernel, passing the user connection processing thread THD to which the SQL statement belongs as a parameter. The execution result check module can obtain the management data structure of the user connection, the management data structure of the current transaction on the user connection, the management data structure of the current SQL statement on the user connection, as well as the parse tree, target execution plan, and execution result of the current SQL statement, thereby obtaining the execution result and related information.

[0119] Furthermore, the execution result check module can call the application scenario engine, and the engine driving module determines the sixth target governance strategy based on the aforementioned method for determining the first target governance strategy to check whether the execution result meets the target conditions and obtain the sixth check result, so it will not be repeated here. Among them, the check of whether the execution result meets the target conditions includes but is not limited to the actual execution time check, the actual number of scanned rows check, the actual resource consumption check, the lock waiting situation check, the number of logs generated by the current transaction check, and the result set size check.

[0120] It should be noted that by checking the execution results, the inspection process of this application is enriched, the effectiveness of the returned query results is improved, and thus the inspection effect and query effect are improved.

[0121] In an optional embodiment, after checking whether the execution result meets the target conditions based on the sixth target governance strategy and obtaining the sixth inspection result, the governance system can determine whether to trigger the sixth interception instruction based on the sixth inspection result and the scenario information table, and if it is determined that the sixth interception instruction is not triggered, control the target database to send the query result in the execution result to the terminal device, wherein the query result corresponds to the database statement.

[0122] Optionally, the governance system can determine whether to trigger the sixth interception instruction based on the aforementioned method of determining whether to trigger the first interception instruction, and when the disposal measure is triggered, use the aforementioned method for processing the disposal measure to process this disposal measure, so it will not be repeated here.

[0123] Furthermore, when it is determined that the sixth interception instruction is not triggered, the governance system can control the target database to send the query result in the execution result to the terminal device, wherein the query result is the query content corresponding to the database statement, that is, Figure 2 At this point, the execution process of an SQL statement is completed.

[0124] It should be noted that by returning the query result without triggering the sixth interception instruction, the accuracy of the query result is improved.

[0125] In an optional embodiment, the governance system may also obtain a target scenario information table and update the scenario information table to the target scenario information table to update the strategy tree, wherein the scenario information table also includes the strategy tree.

[0126] Optionally, when it is necessary to modify the SQL governance policy corresponding to the specified SQL statement query scenario, for example, when modifying the combination conditions of the SQL check rules, the staff can use the standard SQL UPDATE statement to modify the scenario information table to obtain the target scenario information table, and then the governance system obtains the target scenario information table and updates the scenario information table to the target scenario information table to update the policy tree. Afterwards, the governance system can reload the SQL governance function module to implement the application of the updated policy tree. In addition, by configuring or modifying each query scenario and SQL governance policy through standard SQL statements, no additional system configuration variables or configuration files are added, which facilitates the centralized and unified configuration management of large-scale database nodes in the production environment, thereby having the advantage of a user-friendly interface and improving the practicality of this application.

[0127] It should be noted that this avoids the problem in the existing technology that the relevant governance system is highly coupled with the database kernel, and function upgrades require database version upgrades, which affects business continuity, thereby improving the work efficiency of this application and reducing work costs.

[0128] In an optional embodiment, the governance system may respond to the update instruction, obtain the target program, and then update the current program based on the target program to update at least one rule unit among the multiple rule units.

[0129] Optionally, when the SQL governance function needs to be upgraded, such as to support new SQL check rules or to modify existing SQL check rules, the staff can modify the code of the SQL governance function module, obtain the target program, compile it into a shared link library sqlgovern.so, and then dynamically load it into the database process space, thereby updating the current program based on the target program and, in turn, updating the rule unit. This avoids modifying the original code of the target database SQL execution processing logic, and also avoids database version upgrades or database restarts, thereby improving the work efficiency of this application and reducing work costs.

[0130] It can be seen that the solution provided by the present application achieves the purpose of using different inspection rules to check database statements in different scenarios, thereby achieving the technical effect of improving the inspection precision, and further solving the technical problem of low inspection precision caused by using unified inspection rules to check database statements in different scenarios in the existing technology.

[0131] Example 2

[0132] According to an embodiment of the present invention, an embodiment of a database statement checking system is provided, wherein: Figure 3 is a schematic diagram of an optional database statement checking device according to an embodiment of the present invention, such as Figure 3 As shown, the system includes:

[0133] A target database is used to obtain database statements and process the database statements to determine query results corresponding to the database statements;

[0134] Optionally, the target database can respond to input instructions from a user or application program, obtain a database statement, and then, based on preset execution processing logic, perform parsing, preprocessing, optimization, and execution on the database to obtain a query result corresponding to the database statement. The database statement can be an SQL statement or other statement. In this embodiment, an SQL statement is used as an example for illustration.

[0135] The governance system is loaded in the process space of the target database and is used to determine the query scenario corresponding to the database statement and the strategy tree corresponding to the query scenario before the target database processes the database statement. Based on the strategy tree, the database statement is string checked to obtain the inspection result, and based on the inspection result, it is determined whether to trigger the interception instruction, wherein the interception instruction is used to intercept the target database from processing the database statement.

[0136] Optional, such as Figure 2 As shown, the governance system includes at least an SQL governance module, which is dynamically loaded into the target database's process space. Specifically, the SQL governance module can be automatically loaded when the database is started, or manually loaded during database operation. The SQL governance module is compiled using gcc --share technology into a shared library, sqlgovern.so. This is dynamically loaded into the database process space using a dynamic linker, enabling a set of SQL governance interface points pre-set within the database kernel's SQL execution process to call the various check modules within the SQL governance module.

[0137] During the application process, optionally, before the target database processes the database statement, the target database can call the text inspection module in the SQL governance function module based on the SQL governance interface point, so that the text inspection module determines the query scenario corresponding to the database statement based on the user identifier corresponding to the database statement, and determines the policy tree corresponding to the query scenario, thereby performing a string inspection on the database statement based on the policy tree, obtaining the inspection result, and determining whether to trigger the interception instruction based on the inspection result.

[0138] It is easy to notice that in the above process, by dynamically loading the SQL governance function module into the process space of the target database, the existing technology avoids the limited SQL governance function due to insufficient information foundation when the relevant system is implemented outside the database kernel (for example: application layer SQL governance, front-end SQL governance), or the large impact of code changes when the relevant system is implemented in the data kernel because SQL governance involves various links in the SQL statement execution processing logic. This achieves the acquisition of all database internal information during the database SQL statement processing process, thereby improving the comprehensiveness of database statement inspection and ensuring that the inspection function is comprehensive while achieving low database kernel intrusion. In addition, by determining the query scenario corresponding to the database statement and inspecting the database statement based on the inspection logic corresponding to the determined query scenario, it is possible to achieve differential inspection of database statements under different query scenarios, thereby improving the inspection precision and thus improving the inspection effect.

[0139] It can be seen that the solution provided by the present application achieves the purpose of using different inspection rules to check database statements in different scenarios, thereby achieving the technical effect of improving the inspection precision, and further solving the technical problem of low inspection precision caused by using unified inspection rules to check database statements in different scenarios in the existing technology.

[0140] In an optional embodiment, the target database includes: a parser, an optimizer, and an executor;

[0141] The parser has a text checking interface at its input and a parse tree checking interface at its output. The parser is used to parse the database statement to obtain a parse tree.

[0142] An optimizer, wherein the input end of the optimizer is provided with a preprocessing check interface, and the output end of the optimizer is provided with an index matching interface. The optimizer is used to optimize the target parse tree to obtain a target execution plan, wherein the target parse tree corresponds to the parse tree;

[0143] An executor, wherein the input end of the executor is provided with an execution plan checking interface, and the output end of the executor is provided with an execution result checking interface. The executor is used to execute the target execution plan to obtain an execution result, which at least includes a query result;

[0144] The text checking interface, the parse tree checking interface, the preprocessing checking interface, the index matching interface, the execution plan checking interface and the execution result checking interface are connected to the governance system.

[0145] Optional, such as Figure 2 As shown, the target database includes a connector, a parser, an optimizer and an executor, wherein the parser is used to parse the database statement to obtain a parse tree, the optimizer is used to optimize the target parse tree corresponding to the parse tree, and the executor is used to execute the target execution plan to obtain the query result.

[0146] Furthermore, if Figure 2 As shown, the management system also includes a set of SQL management interface points preset in the original processing flow of the target database. This set of SQL management interface points is set in the target database and is responsible for initiating calls to SQL management functions at appropriate locations in the database kernel SQL execution processing flow. This set of SQL management interface points includes a text check interface (i.e., Figure 2 The parsing tree checking interface (i.e. Figure 2 2), the preprocessing check interface called before the SQL statement enters the optimizer (i.e. Figure 2 3 in the SQL statement), the index matching check interface called after the optimizer completes the SQL statement processing (i.e. Figure 2 4), the execution plan check interface called before the SQL statement enters the executor (i.e. Figure 2 5 in the ), and the execution result check interface called after the SQL statement completes the executor processing (i.e. Figure 2 6 in the figure).

[0147] It's important to note that by centralizing SQL checking functionality to a set of SQL governance interface points pre-set at the entry and return points of core database components, interacting with the SQL governance module, SQL checking functionality expansion and upgrades require only the dynamic loading of new SQL governance modules, without modifying the database's existing SQL processing logic or upgrading the database version. This ensures uninterrupted database service and minimizes intrusion into the database's core logic. For applications such as the financial industry that strictly require business continuity and system stability, this feature can significantly reduce the operational management costs and operational risks of large-scale database nodes in production environments, enabling rapid iteration of SQL governance functionality as application SQL code changes.

[0148] In an optional embodiment, as Figure 2 As shown, the management system includes not only the SQL management function module and a set of SQL management interface points, but also an SQL application scenario information table, an SQL management recording device, and an SQL management management platform. Among them, the SQL application scenario information table is the aforementioned scenario information table.

[0149] Among them, the SQL governance function module is responsible for the specific implementation of the SQL checking function in the database kernel process.

[0150] The SQL application scenario information table is responsible for recording information related to the SQL application scenario, including the scenario name, scenario description, database user name, and the SQL governance policy for the scenario.

[0151] The SQL management recording device is responsible for recording detailed information about SQL statements that trigger SQL management interception / alarm processing, including but not limited to timestamps, SQL statement text, SQL statement execution plan, detailed time of each SQL statement execution step, number of scanned rows, lock wait information, CPU and IO resource consumption information, and violated SQL check rules.

[0152] The SQL governance management platform is responsible for connecting to the SQL governance recording devices of multiple database instances, as well as managing the work order flow for SQL problem handling.

[0153] Furthermore, the SQL governance function module may include a set of SQL governance check modules, an application scenario engine, a processing module and multiple SQL governance rule units.

[0154] Among them, the SQL governance check module is used to implement the specific functions of the corresponding SQL governance check interface points. The SQL governance check module includes a text check module, a parse tree check module, a preprocessing check module, an index matching check module, an execution plan check module, and an execution result check module. Specifically, the text check module is responsible for checking the SQL statement text string. The parse tree check module is responsible for performing a structural check on the SQL parse tree. The preprocessing check module is responsible for checking and processing SQL for equivalent rewriting and true / false condition judgment. The index matching check module is responsible for checking the matching between SQL and table index definitions. The execution plan check module is responsible for checking the execution plan COST overhead. The execution result check module is responsible for checking the actual SQL execution status, such as SQL execution time, number of result set rows, and resource consumption.

[0155] SQL governance rule unit is used to implement a single SQL check rule.

[0156] The application scenario engine includes an initialization module and an engine driver module. The initialization module is used to initialize the SQL governance policies corresponding to each SQL application scenario into a scenario-specific policy tree based on the data in the SQL application scenario information table. The engine driver module is used to combine SQL governance rule units according to the combination logic of the scenario-specific policy tree to implement the functions of the SQL governance check module.

[0157] The processing module is used to issue alarms or intercept SQL statement execution based on the processing measures defined in the SQL management policy.

[0158] Example 3

[0159] According to an embodiment of the present invention, an embodiment of a device for checking database statements is provided, wherein: Figure 3 is a schematic diagram of an optional database statement checking device according to an embodiment of the present invention, such as Figure 3 As shown, the device includes:

[0160] The acquisition module 301 is used to acquire the database statement to be checked;

[0161] A first determination module 302 is used to determine a query scenario corresponding to a database statement;

[0162] A second determination module 303 is configured to determine a strategy tree corresponding to the query scenario, wherein the strategy tree represents a check logic for checking the database statement;

[0163] The checking module 304 is configured to perform a string check on the database statement based on the strategy tree to obtain a first checking result.

[0164] It should be noted that the above-mentioned acquisition module, first determination module, second determination module and inspection module correspond to steps S101 to S104 in the above-mentioned embodiment. The examples and application scenarios implemented by the four modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned embodiment 1.

[0165] Optionally, the acquisition module also includes: a first sub-acquisition module, used to acquire a first call instruction, wherein the first call instruction is an instruction sent by the target database before the database statement is input into the parser, the target database is the database processed by the database statement, and the parser is set in the target database; a second sub-acquisition module, used to acquire the database statement based on the first call instruction.

[0166] Optionally, the inspection module also includes: a first determination module, used to determine the stage information corresponding to the database statement, wherein the stage information is used to characterize the processing status of the database processing the database statement; a second determination module, used to determine at least one target rule unit from multiple rule units based on the policy tree and the stage information corresponding to the database statement, wherein the target rule unit is used to inspect the database statement; a third determination module, used to determine the combination logic based on the policy tree; a combination module, used to combine at least one target rule unit based on the combination logic to obtain a first target governance policy; a first sub-inspection module, used to perform a string check on the database statement based on the first target governance policy to obtain a first inspection result.

[0167] Optionally, the database statement inspection device also includes: a fourth determination module, used to determine whether to trigger the first interception instruction based on the first inspection result and the scenario information table, wherein the scenario information table is at least used to characterize the conditions for triggering the interception instruction to intercept the target database; a control module, used to control the target database to input the database statement into the parser when it is determined that the first interception instruction is not triggered; a third sub-acquisition module, used to obtain a parse tree, wherein the parse tree is obtained by the parser parsing the database statement; a fifth determination module, used to determine the second target governance strategy based on the strategy tree, the stage information corresponding to the parse tree, and multiple rule units; a second sub-inspection module, used to perform a structured inspection on the parse tree based on the second target governance strategy to obtain a second inspection result.

[0168] Optionally, the database statement inspection device also includes: a sixth determination module, used to determine whether to trigger the second interception instruction based on the second inspection result and the scenario information table; a second control module, used to control the target database to process the parse tree to obtain a target parse tree when it is determined that the second interception instruction is not triggered; a seventh determination module, used to determine a third target governance strategy based on the strategy tree, the stage information corresponding to the target parse tree, and multiple rule units; a third sub-inspection module, used to perform a format check on the target parse tree based on the third target governance strategy to obtain a third inspection result.

[0169] Optionally, the database statement inspection device also includes: an eighth determination module, used to determine whether to trigger the third interception instruction based on the third inspection result and the scenario information table; a third control module, used to control the target database to input the target parsing tree into the optimizer when it is determined that the third interception instruction is not triggered, wherein the optimizer is set in the target database; a third sub-acquisition module, used to obtain the target execution plan, wherein the target execution plan is obtained by optimizing the target parsing tree by the optimizer; a ninth determination module, used to determine the fourth target governance strategy based on the strategy tree, the first stage information corresponding to the target execution plan, and multiple rule units; a fourth sub-inspection module, used to perform an index field inspection on the target execution plan based on the fourth target governance strategy to obtain a fourth inspection result.

[0170] Optionally, the database statement inspection device also includes: a tenth sub-determination module, used to determine whether to trigger the fourth interception instruction based on the fourth inspection result and the scenario information table; a fourth control module, used to control the target database to input the target execution plan into the executor when it is determined that the fourth interception instruction is not triggered and the target execution plan meets the preset conditions, wherein the executor is set in the target database.

[0171] Optionally, the fourth control module also includes: an eleventh sub-determination module, which is used to determine the fifth target governance strategy based on the strategy tree, the second stage information corresponding to the target execution plan, and multiple rule units when it is determined that the fourth interception instruction is not triggered; a fifth sub-inspection module, which is used to check whether the target execution plan meets the execution conditions based on the fifth target governance strategy, and obtain a fifth inspection result; a twelfth sub-determination module, which is used to determine whether the fifth interception instruction is triggered based on the fifth inspection result and the scenario information table; and a fifth control module, which is used to determine that the target execution plan meets the preset conditions when it is determined that the fifth interception instruction is not triggered, and control the target database to input the target execution plan into the executor.

[0172] Optionally, the database statement inspection device also includes: a fourth sub-acquisition module, used to obtain the execution result, wherein the execution result is obtained by the executor executing the target execution plan; a thirteenth sub-determination module, used to determine the sixth target governance strategy based on the strategy tree, the stage information corresponding to the execution result, and multiple rule units; a sixth sub-inspection module, used to check whether the execution result meets the target condition based on the sixth target governance strategy, and obtain a sixth inspection result.

[0173] Optionally, the database statement inspection device also includes: a fourteenth sub-determination module, used to determine whether to trigger the sixth interception instruction based on the sixth inspection result and the scenario information table; a sixth control module, used to control the target database to send the query result in the execution result to the terminal device when it is determined that the sixth interception instruction is not triggered, wherein the query result corresponds to the database statement.

[0174] Example 4

[0175] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is configured to execute the above-mentioned database statement checking method when running.

[0176] Example 5

[0177] According to another aspect of an embodiment of the present invention, an electronic device is provided, wherein: Figure 4 is a schematic diagram of an optional electronic device according to an embodiment of the present invention, such as Figure 4 As shown, the electronic device includes one or more processors; a memory for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement the method for running the programs, wherein the programs are configured to execute the above-mentioned database statement checking method at runtime.

[0178] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0179] In the above embodiments of the present invention, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0180] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0181] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected to achieve the purpose of the present embodiment according to actual needs.

[0182] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0183] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc. Various media that can store program codes.

[0184] The above are only preferred embodiments of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for checking database statements, characterized in that: include: Get the database statement to be checked; Determining a query scenario corresponding to the database statement; Determining a strategy tree corresponding to the query scenario, wherein the strategy tree represents a check logic for checking the database statement; Based on the strategy tree, performing a string check on the database statement to obtain a first check result; The method further includes: obtaining a first call instruction, wherein the first call instruction is an instruction sent by the target database before the database statement is input into the parser; determining at least one target rule unit from a plurality of rule units based on the strategy tree and the phase information corresponding to the database statement; After performing a string check on the database statement based on the strategy tree to obtain a first check result, the method further includes: Determining whether to trigger a first interception instruction based on the first check result and a scenario information table, wherein the scenario information table is at least used to represent a condition for triggering the interception instruction to intercept the target database; If it is determined that the first interception instruction is not triggered, controlling the target database to input the database statement into the parser; Obtaining a parse tree, wherein the parse tree is obtained by the parser parsing the database statement; Determining a second target governance strategy based on the strategy tree, the stage information corresponding to the parsing tree, and the multiple rule units; Based on the second target governance strategy, a structural check is performed on the parse tree to obtain a second check result.

2. The method according to claim 1, characterized in that Get the database statements to be checked, including: Obtaining a first call instruction, wherein the target database is a database processed by the database statement, and the parser is set in the target database; Based on the first calling instruction, the database statement is obtained.

3. The method according to claim 2, characterized in that Based on the strategy tree, a string check is performed on the database statement to obtain a first check result, including: Determining phase information corresponding to the database statement, wherein the phase information is used to represent a processing state of the database statement processed by the database; The target rule unit is used to check the database statement; Determine combination logic according to the strategy tree; Combining the at least one target rule unit based on the combination logic to obtain a first target governance policy; Based on the first target governance policy, a character string check is performed on the database statement to obtain a first check result.

4. The method according to claim 1, wherein After performing a structural check on the parse tree based on the second target governance strategy to obtain a second check result, the method further includes: Determining whether to trigger a second interception instruction based on the second inspection result and the scenario information table; If it is determined that the second interception instruction is not triggered, controlling the target database to process the parse tree to obtain a target parse tree; Determining a third target governance strategy based on the strategy tree, the stage information corresponding to the target parsing tree, and the multiple rule units; Based on the third target governance strategy, a format check is performed on the target parse tree to obtain a third check result.

5. The method according to claim 4, characterized in that After performing a format check on the target parse tree based on the third target governance strategy and obtaining a third check result, the method further includes: Based on the third check result and the scenario information table, determining whether to trigger a third interception instruction; If it is determined that the third intercept instruction is not triggered, controlling the target database to input the target parse tree into an optimizer, wherein the optimizer is set in the target database; Obtaining a target execution plan, wherein the target execution plan is obtained by the optimizer performing optimization processing on the target parse tree; Determining a fourth target governance strategy based on the strategy tree, the first phase information corresponding to the target execution plan, and the multiple rule units; Based on the fourth target governance strategy, an index field check is performed on the target execution plan to obtain a fourth check result.

6. The method according to claim 5, characterized in that After performing an index field check on the target execution plan based on the fourth target governance strategy and obtaining a fourth check result, the method further includes: Determining whether to trigger a fourth interception instruction based on the fourth check result and the scenario information table; When it is determined that the fourth interception instruction is not triggered and the target execution plan meets a preset condition, the target database is controlled to input the target execution plan into an executor, wherein the executor is set in the target database.

7. The method according to claim 6, characterized in that When it is determined that the fourth interception instruction is not triggered and the target execution plan meets a preset condition, controlling the target database to input the target execution plan into the executor includes: When it is determined that the fourth interception instruction is not triggered, determining a fifth target governance strategy according to the strategy tree, the second phase information corresponding to the target execution solution, and the multiple rule units; Based on the fifth target governance strategy, checking whether the target execution plan meets the execution condition, and obtaining a fifth checking result; Determining whether to trigger a fifth interception instruction based on the fifth check result and the scenario information table; When it is determined that the fifth interception instruction is not triggered, it is determined that the target execution plan meets a preset condition, and the target database is controlled to input the target execution plan into the executor.

8. The method according to claim 7, characterized in that After controlling the target database to input the target execution plan into the executor, the method further includes: Obtaining an execution result, wherein the execution result is obtained by the executor executing the target execution plan; determining a sixth target governance strategy based on the strategy tree, the stage information corresponding to the execution result, and the multiple rule units; Based on the sixth target governance strategy, check whether the execution result meets the target condition to obtain a sixth check result.

9. The method according to claim 8, characterized in that After checking whether the execution result meets the target condition based on the sixth target governance strategy and obtaining the sixth check result, the method further includes: Determining whether to trigger a sixth interception instruction based on the sixth check result and the scenario information table; When it is determined that the sixth interception instruction is not triggered, the target database is controlled to send a query result in the execution result to a terminal device, wherein the query result corresponds to the database statement.

10. A database statement checking system, characterized in that: include: A target database, configured to obtain a database statement and process the database statement to determine a query result corresponding to the database statement; a governance system, the governance system being loaded into the process space of the target database and configured to, before the target database processes the database statement, determine a query scenario corresponding to the database statement and determine a policy tree corresponding to the query scenario, thereby performing a string check on the database statement based on the policy tree to obtain a first check result, and determining whether to trigger a first interception instruction based on the first check result, wherein the first interception instruction is configured to intercept the target database from processing the database statement; and the policy tree represents the check logic for checking the database statement; The governance system is further configured to obtain a first call instruction, wherein the first call instruction is an instruction sent by the target database before the database statement is input into the parser; determine at least one target rule unit from a plurality of rule units based on the strategy tree and the phase information corresponding to the database statement; The governance system is also used to determine whether to trigger a first interception instruction based on the first inspection result and the scenario information table, wherein the scenario information table is at least used to characterize the conditions for triggering the interception instruction to intercept the target database; when it is determined that the first interception instruction is not triggered, control the target database to input the database statement into the parser; obtain a parse tree, wherein the parse tree is obtained by the parser parsing the database statement; determine a second target governance strategy based on the strategy tree, the stage information corresponding to the parse tree, and the multiple rule units; based on the second target governance strategy, perform a structured check on the parse tree to obtain a second check result.

11. The system according to claim 10, wherein: The target database includes: a parser, an optimizer, and an executor; A parser, wherein an input end of the parser is provided with a text checking interface, an output end of the parser is provided with a parse tree checking interface, and the parser is used to parse the database statement to obtain a parse tree; An optimizer, wherein an input end of the optimizer is provided with a preprocessing check interface, an output end of the optimizer is provided with an index matching interface, and the optimizer is used to optimize a target parse tree to obtain a target execution plan, wherein the target parse tree corresponds to the parse tree; An executor, wherein an execution scheme checking interface is provided at an input end of the executor, and an execution result checking interface is provided at an output end of the executor, and the executor is used to execute the target execution scheme to obtain an execution result, wherein the execution result at least includes the query result; The text checking interface, the parse tree checking interface, the preprocessing checking interface, the index matching interface, the execution plan checking interface, and the execution result checking interface are connected to the governance system.

12. A database statement checking device, characterized in that: include: The acquisition module is used to obtain the database statement to be checked; A first determining module, configured to determine a query scenario corresponding to the database statement; A second determination module is configured to determine a strategy tree corresponding to the query scenario, wherein the strategy tree represents a check logic for checking the database statement; A checking module, configured to perform a string check on the database statement based on the strategy tree to obtain a first checking result; The device is further configured to obtain a first call instruction, wherein the first call instruction is an instruction sent by the target database before the database statement is input into the parser; determine at least one target rule unit from a plurality of rule units based on the strategy tree and the phase information corresponding to the database statement; The device is further configured to determine whether to trigger a first interception instruction based on the first inspection result and a scenario information table, wherein the scenario information table is at least used to characterize the conditions for triggering the interception instruction for intercepting the target database; when it is determined that the first interception instruction is not triggered, control the target database to input the database statement into the parser; obtain a parse tree, wherein the parse tree is obtained by the parser parsing the database statement; determine a second target governance strategy based on the strategy tree, the stage information corresponding to the parse tree, and the multiple rule units; and perform a structured check on the parse tree based on the second target governance strategy to obtain a second inspection result.

13. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program is configured to execute the database statement checking method according to any one of claims 1 to 9 when running.

14. An electronic device, characterized in that: The electronic device includes one or more processors; A memory for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement a method for running the program, wherein the program is configured to execute the database statement checking method described in any one of claims 1 to 9 at runtime.

Images