SYSTEM Cited by 1 source
SQLancer¶
What it is¶
SQLancer (Synthesized Query Lancer) is an automated DBMS-testing tool originating in Manuel Rigger's research group at the National University of Singapore. The GitHub repository is at github.com/sqlancer/sqlancer.
SQLancer finds logic bugs in DBMSes — bugs where a query returns a logically incorrect result set (missing rows, extra rows, wrong aggregates) relative to a mathematical oracle derived from the SQL standard.
Why it shows up on this wiki¶
Canonicalised via Arvind Murty's 2023 Vitess-planner-fuzzer retrospective (sources/2026-04-21-planetscale-summer-2023-fuzzing-vitess-at-planetscale) as the substrate the Vitess team explicitly did not adopt. Two reasons, both load-bearing:
- Oracle mismatch — SQLancer tests for logical-correctness-per-SQL-standard; Vitess's compatibility contract is bug-for-bug compatibility with MySQL, not with the SQL standard. See concepts/sqlancer-logic-bug for the full disjoint- bug-class taxonomy.
- Sharding not modelled — SQLancer assumes a single-node DBMS; Vitess's planner makes routing and pushdown decisions based on VSchema metadata SQLancer's generator doesn't produce.
The Vitess team instead built a bespoke MySQL- compatible differential fuzzer.
Oracle techniques¶
SQLancer ships three distinct oracle techniques, each with its own research paper:
- PQS — Pivoted Query Synthesis. Generate queries that must return a specific pivot row by construction; if the DBMS's result omits the pivot row, that's a bug.
- NoREC — Non-optimising Reference Engine Construction. Rewrite the query into an optimisation-resistant form; if the two plans return different results, one is buggy.
- TLP — Ternary Logic Partitioning. Split
SELECT …into three partitions over a predicate (WHERE p,WHERE NOT p,WHERE p IS NULL); their union must equal the unfiltered result.
SQLancer has found bugs in many production DBMSes (SQLite, PostgreSQL, MariaDB, CockroachDB, DuckDB, TiDB, etc.) — its track record on standards-compliant DBMSes is strong.
Seen in¶
- sources/2026-04-21-planetscale-summer-2023-fuzzing-vitess-at-planetscale — canonical "explicitly-rejected substrate" reference. Verbatim framing: "SQLancer had been very successful at finding bugs in well-established DBMSs, such as SQLite and MySQL, so we thought it might work well for Vitess. But there were three main problems: Vitess ideally should perfectly mimic MySQL, quirks included. SQLancer on the other hand compares queries to an oracle, which determines if queries are logically correct. Vitess has the added layer of the VSchema. [...] It would take a lot of work to properly integrate Vitess with SQLancer, due to each DBMS tester in SQLancer essentially being written completely separately with similar logic."