[GH-ISSUE #146] [Bug] Unescaped SQL queries cause near "in": syntax error and save failures when path contains reserved words or brackets #101

New issue

Open

opened 2026-10-13 19:49:57 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 19:49:57 +00:00

Owner

Originally created by @JingShing on GitHub (Aug 24, 2026).
Original GitHub issue: https://github.com/Yuvi9587/Kemono-Downloader/issues/146

Originally assigned to: @Yuvi9587 on GitHub.

When downloading posts from a creator whose username or ID is or contains SQL reserved words (such as in), the downloader fails to record downloaded files to the local database and throws an internal SQL syntax error:
->>Save Fail for '<filename>': near "in": syntax error

Because the database write fails, all downloaded files are treated as failed/discarded, and the clean-up routine removes the target subfolders (even if the local save directory path itself contains no special characters or reserved words).

To Reproduce

Attempt to download posts from a creator whose name/service ID is in (e.g., URL containing /user/in or creator name in).
Set a regular output folder (e.g., E:\kemono\Paw\fanbox30000).
Start the download process.
Observe the error log after each file is fetched:

✅ Saved: 'cover.jpeg' (from 'cover.jpeg', 0.08 MB) in '2026-08-21 ...'
->>Save Fail for 'cover.jpeg': near "in": syntax error

Expected Behavior
Downloads and database tracking records should complete successfully regardless of creator names or service identifiers containing SQL keywords (in, select, order, etc.). Database operations should use parameterized queries (e.g., SQLite ? placeholders) rather than raw string formatting/f-strings to construct SQL statements.

Relevant Log Output

⬇️ Downloading (Single Stream): 'cover.jpeg'
✅ Saved: 'cover.jpeg' (from 'cover.jpeg', 0.08 MB) in '2026-08-21 Perfect Idol\'s Private alt Uncensored'
->>Save Fail for 'cover.jpeg': near "in": syntax error
   Post 12460551 Summary: Downloaded=0, Skipped Files=1
   🗑️ Removing empty post-specific subfolder: 'E:\kemono\Paw\...'

Originally created by @JingShing on GitHub (Aug 24, 2026). Original GitHub issue: https://github.com/Yuvi9587/Kemono-Downloader/issues/146 Originally assigned to: @Yuvi9587 on GitHub. When downloading posts from a creator whose username or ID is or contains SQL reserved words (such as `in`), the downloader fails to record downloaded files to the local database and throws an internal SQL syntax error: `->>Save Fail for '<filename>': near "in": syntax error` Because the database write fails, all downloaded files are treated as failed/discarded, and the clean-up routine removes the target subfolders (even if the local save directory path itself contains no special characters or reserved words). --- **To Reproduce** 1. Attempt to download posts from a creator whose name/service ID is `in` (e.g., URL containing `/user/in` or creator name `in`). 2. Set a regular output folder (e.g., `E:\kemono\Paw\fanbox30000`). 3. Start the download process. 4. Observe the error log after each file is fetched: ```text ✅ Saved: 'cover.jpeg' (from 'cover.jpeg', 0.08 MB) in '2026-08-21 ...' ->>Save Fail for 'cover.jpeg': near "in": syntax error ``` --- **Expected Behavior** Downloads and database tracking records should complete successfully regardless of creator names or service identifiers containing SQL keywords (`in`, `select`, `order`, etc.). Database operations should use parameterized queries (e.g., SQLite `?` placeholders) rather than raw string formatting/f-strings to construct SQL statements. --- **Relevant Log Output** ```text ⬇️ Downloading (Single Stream): 'cover.jpeg' ✅ Saved: 'cover.jpeg' (from 'cover.jpeg', 0.08 MB) in '2026-08-21 Perfect Idol\'s Private alt Uncensored' ->>Save Fail for 'cover.jpeg': near "in": syntax error Post 12460551 Summary: Downloaded=0, Skipped Files=1 🗑️ Removing empty post-specific subfolder: 'E:\kemono\Paw\...' ```