fix(kv): prepare ts query (#3767)

Signed-off-by: Zeroday BYTE <[email protected]>
Signed-off-by: Jiyong Huang <[email protected]>
Co-authored-by: Jiyong Huang <[email protected]>

Author: odaysec

internal/pkg/store/sql/sqlTs.go

@@ -39,12 +39,12 @@ func createSqlTs(database Database, table string) (*ts, error) {
 		last:     getLast(database, table),
 	}
 	err := store.database.Apply(func(db *sql.DB) error {
-		query := fmt.Sprintf("CREATE TABLE IF NOT EXISTS '%s'('key' INTEGER PRIMARY KEY, 'val' BLOB);", table)
+		query := fmt.Sprintf("CREATE TABLE IF NOT EXISTS %s ('key' INTEGER PRIMARY KEY, 'val' BLOB);", table)
 		stmt, err := db.Prepare(query)
 		if err != nil {
 			return err
 		}
-		_, err = stmt.Exec(query)
+		_, err = stmt.Exec()
 		return err
 	})
 	if err != nil {
@@ -158,13 +158,16 @@ func (t ts) Drop() error {
 
 func getLast(d Database, table string) int64 {
 	var last int64 = 0
+	if !isValidTableName(table) {
+		return 0 // or handle the error appropriately
+	}
 	_ = d.Apply(func(db *sql.DB) error {
-		query := fmt.Sprintf("SELECT key FROM %s Order by key DESC Limit 1;", table)
+		query := fmt.Sprintf("SELECT key FROM %s ORDER BY key DESC LIMIT 1;", table)
 		stmt, err := db.Prepare(query)
 		if err != nil {
 			return err
 		}
-		row := stmt.QueryRow(query)
+		row := stmt.QueryRow()
 		return row.Scan(&last)
 	})
 	return last