SQLite Forum

Crash when a RETURNING clause refers to a table in UPDATE FROM
Login
There is a bug in all prior versions of SQLite 3.35 that allows nonsense table
names in the RETURNING clause.  RETURNING is currently only able to return
columns from the single table being updated.  For the case of an UPDATE FROM,
the additional tables in the FROM clause cannot be referenced by RETURNING.

But SQLite fails to detect this problem.  In fact, if it encounters a table name
that it does not recognize, it quietly ignores it and just pulls the column off
of the table being updated.  Consider an example:

> ~~~
CREATE TABLE t1(a INT,b INT);
INSERT INTO t1(a,b) VALUES(1,2);
UPDATE t1 SET b=b+1 RETURNING nosuchtable.a, another.b;
~~~

Even though there are no tables named "nosuchtable" or "another", the table
names in the RETURNING clause are silently ignored
and the "a" and "b" columns of table "t1" are used.
It works as if the clause has been "`RETURNING a, b`".

I will strive to fix this oversight in the next patch release.