← Research building on SQLancer

Yongxin Chen, Zhiyuan Jiang, Chao Zhang, Haoran Xu, Shenglin Xu, Jianping Tang, Zheming Li, Peidai Xie, Yongjun Wang. 2026. arXiv.org.

Read the paper · arXiv:2602.19490

What this paper does with SQLancer

SQLancer is one of three state-of-the-art open-source baselines, alongside Squirrel and EET. The comparison required accommodation in both directions: because SQLancer is not a grey-box tool, the authors collected its generated test cases and replayed them through FuzzySQL's own mechanism to measure coverage, and because SQLancer pairs different oracles with different systems they ran TLP for MySQL and NoREC for the other targets. That constraint is noted as a property of SQLancer's design rather than a shortcoming. Bug counts are reported per target over 24 hours. FuzzySQL targets the special features of individual DBMSs -- vendor-specific syntax and subsystems that general-purpose generators do not model -- using a language model to produce test cases for them. Its argument is that existing fuzzers concentrate on general statement structures, so features unique to one system go untested. It is evaluated on MySQL and other systems against mutation-based and generation-based baselines. Written by claude-opus-5 from the 11 places this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer's test cases are collected and replayed to measure its coverage on equal terms, which is part of running it as a baseline rather than reuse in FuzzySQL's own generation.

extends technique — no

No SQLancer oracle is extended; FuzzySQL generates test cases for vendor-specific features with a language model.

compares with — yes

M3 names SQLancer among the three baselines, M5 describes how its test cases were collected for the coverage comparison, M6 records TLP being used for MySQL and NoREC for the other targets, and M8 gives the 24-hour bug table.

Ternary Logic Partitioning (TLP)Non-optimizing Reference Engine Construction (NoREC)

To demonstrate the advantage of FuzzySQL, we compare it against three state-of-the-art opensource fuzzing baselines: Squirrel [ 56], EET [ 19], and SQLancer [ 35]. M3 · 5.1 Experimental Setup · page 15
Since EET and SQLancer are not inherently a grey-box fuzzing tool, we first collect their generated test cases and then utilize FuzzySQL’s replay mechanism to measure its coverage. M5 · 5.1 Experimental Setup · page 15
For SQLancer, we use TLP [ 36] as the test oracle for MySQL, and NoREC [ 35] for the other DBMS targets. M6 · 5.1 Experimental Setup · page 15
Deduplicated MySQL bugs discovered within 24 hours Target ID†FR Type FuzzySQL Squirrel EET SQLancer FuzzySQL! M8 · 5.2 Bug Discovery Effectiveness · page 16

describes as state of the art — yes

M3 describes SQLancer as one of three state-of-the-art open-source fuzzing baselines.

To demonstrate the advantage of FuzzySQL, we compare it against three state-of-the-art opensource fuzzing baselines: Squirrel [ 56], EET [ 19], and SQLancer [ 35]. M3 · 5.1 Experimental Setup · page 15

SQLancer publications it cites (7)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#EntryMatched as
4 Jinsheng Ba and Manuel Rigger. 2023. Testing database engines via query plan guidance. In2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE). IEEE, 2060–2071. sqlancer publication · QPG
5 Jinsheng Ba and Manuel Rigger. 2024. Cert: Finding performance issues in database systems through the lens of cardinality estimation. InProceedings of the IEEE/ACM 46th International Conference on Software Engineering... sqlancer publication · CERT
35 Manuel Rigger and Zhendong Su. 2020. Detecting optimization bugs in database engines via non-optimizing reference engine construction. InProceedings of the 28th ACM Joint Meeting on European Software Engineering Confe... sqlancer publication · NOREC
36 Manuel Rigger and Zhendong Su. 2020. Finding bugs in database systems via query partitioning.Proceedings of the ACM on Programming Languages4, OOPSLA, Article 211 (2020), 30 pages. doi:10.1145/3428279 sqlancer publication · TLP
37 Manuel Rigger and Zhendong Su. 2020. Testing database engines via pivoted query synthesis. In14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20). 667–682. sqlancer publication · PQS
52 Chi Zhang and Manuel Rigger. 2025. Constant Optimization Driven Database System Testing.Proceedings of the ACM on Management of Data3, 1 (2025), 1–24. sqlancer publication · CODDTEST
57 Suyang Zhong and Manuel Rigger. 2025. Testing Database Systems with Large Language Model Synthesized Fragments. arXiv:2505.02012 [cs.SE] sqlancer publication

Every place it refers to SQLancer (11)

11 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id Sentence Found by Where
M1 However, most existing DBMS fuzzers [ 1,19,23,37,56] predominantly focus on generalpurpose statement structures (e. citation marker
background 		1 Introduction
page 2
M2 Existing DBMS fuzzers have explored SQL generation and mutation from multiple perspectives, including structural complexity [ 18,56], sequence-level interactions [ 13,22], and oracle-guided logic testing [ 19,23,35]. citation marker
background 		1 Introduction
page 2
M3 To demonstrate the advantage of FuzzySQL, we compare it against three state-of-the-art opensource fuzzing baselines: Squirrel [ 56], EET [ 19], and SQLancer [ 35]. name
state of the art 		5.1 Experimental Setup
page 15
M4 Among them, Squirrel represents mutation-based fuzzing, while both EET and SQLancer adopt generation-based approaches. name
definition 		5.1 Experimental Setup
page 15
M5 Since EET and SQLancer are not inherently a grey-box fuzzing tool, we first collect their generated test cases and then utilize FuzzySQL’s replay mechanism to measure its coverage. name
baseline 		5.1 Experimental Setup
page 15
M6 For SQLancer, we use TLP [ 36] as the test oracle for MySQL, and NoREC [ 35] for the other DBMS targets. name
baseline 		5.1 Experimental Setup
page 15
M7 This choice is constrained by the design of SQLancer, which employs different oracle-based testing strategies tailored to specific DBMSs. name
definition 		5.1 Experimental Setup
page 15
M8 Deduplicated MySQL bugs discovered within 24 hours Target ID†FR Type FuzzySQL Squirrel EET SQLancer FuzzySQL! name
result comparison 		5.2 Bug Discovery Effectiveness
page 16
M9 Depending on the bug types targeted—ranging from crash vulnerabilities [ 1,12,13,18, 22,27,45,56] to logic inconsistencies [ 4,19,23,35–37,52] and performance regressions [ 5,20,28, 53]—existing DBMS fuzzers follow either generation-based or mutation-based strategies. citation marker
background 		7.1 DBMS Fuzzing
page 22
M10 SQLancer [ 35–37,52] and EET [ 19] generate ASTs while preserving contextual variable bindings to ensure validity. name
background 		7.1 DBMS Fuzzing
page 22
M11 The concurrent work ShQveL [57] uses LLM to construct fragments and then uses these fragments to combine SQL statements. name 7.1 DBMS Fuzzing
page 22

This page is rendered from _data/papers/paper_arxiv_2602_19490.json, extracted from arxiv. 29 pages, 59 references parsed.