{"record":{"id":"7a1dead2dab89cc0","repo":"googleapis/mcp-toolbox","slug":"invalid-database-name-q-must-match-s","errorCode":null,"errorMessage":"invalid database_name %q: must match %s","messagePattern":"invalid database_name %q: must match (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/util/cloudsqlconnect/inputvalidate.go","lineNumber":75,"sourceCode":"}\n\n// ValidateGCEResourceName checks a VM name or zone name against the standard\n// GCE resource-name rule (lowercase, digits, hyphen; must start with a letter\n// and not end with a hyphen, max 63 chars).\nfunc ValidateGCEResourceName(name, kind string) error {\n\tif !gceResourceRe.MatchString(name) {\n\t\treturn fmt.Errorf(\"invalid %s %q: must match %s\", kind, name, gceResourceRe)\n\t}\n\treturn nil\n}\n\n// ValidateDatabaseName accepts the conservative subset of database identifier\n// characters that's safe in DSNs and code-snippet templates across Postgres,\n// MySQL and SQL Server. It deliberately rejects quotes, semicolons, and\n// whitespace even when the engine itself would accept them.\nfunc ValidateDatabaseName(name string) error {\n\tif !databaseNameRe.MatchString(name) {\n\t\treturn fmt.Errorf(\"invalid database_name %q: must match %s\", name, databaseNameRe)\n\t}\n\treturn nil\n}\n","sourceCodeStart":57,"sourceCodeEnd":79,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/util/cloudsqlconnect/inputvalidate.go#L57-L79","documentation":"ValidateDatabaseName enforces ^[A-Za-z_][A-Za-z0-9_-]{0,62}$ — a deliberately conservative identifier rule (must start with a letter or underscore, up to 63 chars, no quotes/semicolons/whitespace) even when the underlying engine would accept more. This is because the name is interpolated into DSNs and code-snippet templates across Postgres, MySQL, and SQL Server, where loose characters create injection or syntax hazards.","triggerScenarios":"Passing a database_name containing spaces, quotes, semicolons, slashes, dots, Unicode, or a name longer than 63 characters, or one starting with a digit or hyphen.","commonSituations":"Database created with a quoted mixed-case/odd-character identifier (e.g. \"my db\" or \"db-2024!\"); names copied from URLs; names longer than 63 chars auto-generated by CI systems.","solutions":["Rename or choose a database whose name is a plain identifier: letters, digits, underscores, hyphens, starting with a letter or underscore","Strip or replace invalid characters (spaces, quotes, semicolons) in the supplied database_name","If the existing database genuinely has a non-conforming name, create an alias database with a safe name and connect to that"],"exampleFix":"// before\nValidateDatabaseName(\"my db; --\")\n// after\nValidateDatabaseName(\"my_db\")","handlingStrategy":"validation","validationCode":"var databaseNameRe = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_-]{0,62}$`)\nif !databaseNameRe.MatchString(dbName) {\n    return fmt.Errorf(\"database_name %q must be <=63 chars, start with letter/underscore, contain only [A-Za-z0-9_-]\", dbName)\n}","typeGuard":"func isSafeDatabaseName(name string) bool {\n    return regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_-]{0,62}$`).MatchString(name)\n}","tryCatchPattern":"if err := cloudsqlconnect.ValidateDatabaseName(dbName); err != nil {\n    return fmt.Errorf(\"refusing to connect: %w (quotes/semicolons/spaces are rejected for injection safety)\", err)\n}","preventionTips":["Create databases with plain identifier names so they pass cross-engine validation","Do not rely on engine-specific quoting to make exotic names work","Sanitize user-supplied database names before storing or passing them"],"tags":["validation","sql","input-validation"],"backgroundTag":"input-validation-failed","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}