The clause, expression, or query to strip literals from
Optionaldialect: SQLScreeningDialectThe dialect that will run the SQL. Without one, the text must read the same way under every dialect the scanner knows.
The input with each string literal replaced by a space. The input is returned unchanged when it cannot be classified (for example an unterminated literal) or when the dialects disagree on where its literals are, so a denylist still sees all of it.
Replaces each SQL string literal with one space so that a keyword denylist can be applied to the rest without tripping over keywords inside quoted data (e.g.
Comments LIKE '%--%'). Quoted identifiers and comments are left as written.🚨 SECURITY — literals are found by ScanSQLForScreening, which reads the text the way the database does: a quote inside a T-SQL
[…]identifier, a comment or a PostgreSQL$$…$$string opens no literal, and a backslash escapes a quote only inside a PostgreSQLE'…'string. A stripper that removes a span the database does NOT treat as a literal hides everything inside it from the denylist while the database still runs it. Screens should call ScanSQLForScreening directly, which also reports comments and text it cannot classify.