I accidentally removed the WHERE clause from my SQL query in a personal tool. Every row is now the same. I overwrote 206,000+ rows. I have no backup, I am stupid.
“UPDATE table_name SET w = $1, x = $2, z = $4 WHERE y = $3 RETURNING *”,
does not do the same as
“UPDATE table_name SET w = $1, x = $2, y = $3, z = $4 RETURNING *”,
It’s 2 am and my mind blanked out the WHERE, and just wanted the numbers neatly in order of 1234.
Depending on how mission critical your data is…Set up delayed replicas and backups (and test that your backups can actually be restored from). Get a second pair of eyeballs on your query. Set up test environments and run it there before running it in production. The more automated testing you put into your pipeline, the better. Every edit should be committed and tested. (Kubernetes and GitLab Auto DevOps makes this kind of thing a cinch, every branch has a new test environment set up automatically)
Don’t beat yourself up too much though. It happens even to seasoned pros.
I watched someone make this mistake during a screen share, she hit execute and I screamed “wait! You forgot the where!” Fortunately, it was such a huge database that SQL spun for a moment I guess deciding how it was going to do it before actually doing it, she was able to cancel it and ran a couple checks to confirm it hadn’t actually changed anything yet. I don’t think anything computer related has ever gotten my adrenaline going like that before or since
You’re not the first. You won’t be the last. I’m just glad my DB of choice uses transactions by default, so I can see “rows updated: 3,258,123” and back the fuck out of it.
I genuinely believe that UPDATE and DELETE without a WHERE clause should be considered a syntax error. If you want to do all rows for some reason, it should have been something like UPDATE table SET field=value ALL.
Because I’m relatively new at this type of thing, how does that appear on the front end? I’m using a js/html front end and a jsnode backend. Would I just see a popup before I make any changes?
If you’re asking about the information about the number of rows, oracle db clients do that. For nodejs, oracle’s library will provide this number in the response to a dml statement execution. So you can retrieve it in your backend code. You have to write additional code to bring this message to the front-end.
I never should have had write permissions on that database. You can bet they changed that when clinicians had to redo four days of work because the hosting company or whatever only had weekly backups, not daily.
I did that once when I moved from one DB IDE to another and didn’t realise the new one only ran the highlighted part of the query.
there were thousands of medical students going through a long process to find placements with doctors and we had a database and custom state machine to move them through the stages of application and approval.
a bug meant a student had been moved to the wrong state. so I used a snippet of SQL to reset that one student, and as a nervous habit highlighted parts of the query as I reread them to be sure it was correct.
then hit run with the first half highlighted, without the where clause, so everyone in the entire database got moved to the wrong fucking state.
we had 24 hourly backups but I did it late in the evening, and because it was a couple of days before the hard deadline for the students to get their placements done hundreds of students had been updating information that day.
I spent until 4am the next day working out ways to imply what state everyone was in by which other fields had been updated to what, and incidentally found the original bug in the process 😒
anyway, I hope you feel better soon buddy. it sucks but it happens, and not just to you. good luck.
Yeah, I swear it’s part of the culture at some places. At my first full-time job, my boss dropped the production database the week before I started. They lost at least a day of records because of it and he spent most of the first day telling me why writing sql in prod was bad.
It absolutely, totally, never ever happened to me that I had a bunch of backups available that turned out to be effectively unrestorable the moment I needed them. 😭
Add comment