Javascript 開發筆記 - 盡可能使用 npm 指令處理套件安全更新，此例升級 electron 和 electron-builder

之前寫的練習擺在 github 一直收到套件安全的升級通知信（這只是其中一條），以前在處理這個時，都是人工改掉 package.json ，這次來用指令試試：

% git clone https://github.com/changyy/node-electron-based

% cd node-electron-based

% source env_nvm.sh 

Now using node v16.20.2 (npm v8.19.4)

% npm install

npm WARN deprecated asar@3.2.0: Please use @electron/asar moving forward.  There is no API change, just a package name change

npm WARN deprecated electron-osx-sign@0.6.0: Please use @electron/osx-sign moving forward. Be aware the API is slightly different

added 557 packages, and audited 558 packages in 10s

69 packages are looking for funding

  run `npm fund` for details

11 vulnerabilities (4 moderate, 7 high)

To address issues that do not require attention, run:

  npm audit fix

To address all issues (including breaking changes), run:

  npm audit fix --force

Run `npm audit` for details.

接著就如上述所言，用 npm audit fix 查看一下：

% npm audit fix

up to date, audited 558 packages in 860ms

69 packages are looking for funding

  run `npm fund` for details

# npm audit report

electron  <=22.3.24

Severity: high

Depends on vulnerable versions of @electron/get

Electron vulnerable to out-of-package code execution when launched with arbitrary cwd - https://github.com/advisories/GHSA-7x97-j373-85x5

Electron context isolation bypass via nested unserializable return value - https://github.com/advisories/GHSA-p7v2-p9m8-qqg7

Electron affected by libvpx's heap buffer overflow in vp8 encoding - https://github.com/advisories/GHSA-qqvq-6xgj-jw8g

ASAR Integrity bypass via filetype confusion in electron - https://github.com/advisories/GHSA-7m48-wc93-9g85

fix available via `npm audit fix --force`

Will install electron@28.1.4, which is a breaking change

node_modules/electron

got  <11.8.5

Severity: moderate

Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97

fix available via `npm audit fix --force`

Will install electron@28.1.4, which is a breaking change

node_modules/got

  @electron/get  <=1.14.1

  Depends on vulnerable versions of got

  node_modules/@electron/get

minimatch  <3.0.5

Severity: high

minimatch ReDoS vulnerability - https://github.com/advisories/GHSA-f8q6-p94x-37v3

fix available via `npm audit fix`

node_modules/dir-compare/node_modules/minimatch

  dir-compare  <=2.4.0

  Depends on vulnerable versions of minimatch

  node_modules/dir-compare

    @electron/universal  1.0.1 - 1.3.3

    Depends on vulnerable versions of dir-compare

    node_modules/@electron/universal

      app-builder-lib  22.10.4 - 24.0.0-alpha.13

      Depends on vulnerable versions of @electron/universal

      node_modules/app-builder-lib

        dmg-builder  22.10.4 - 24.0.0-alpha.13

        Depends on vulnerable versions of app-builder-lib

        node_modules/dmg-builder

          electron-builder  19.25.0 || 22.10.4 - 24.6.0

          Depends on vulnerable versions of app-builder-lib

          Depends on vulnerable versions of dmg-builder

          Depends on vulnerable versions of simple-update-notifier

          node_modules/electron-builder

semver  7.0.0 - 7.5.1

Severity: moderate

semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw

fix available via `npm audit fix`

node_modules/simple-update-notifier/node_modules/semver

  simple-update-notifier  1.0.7 - 1.1.0

  Depends on vulnerable versions of semver

  node_modules/simple-update-notifier

11 vulnerabilities (4 moderate, 7 high)

To address issues that do not require attention, run:

  npm audit fix

To address all issues (including breaking changes), run:

  npm audit fix --force

使用 npm audit fix --force 處理：

% npm audit fix --force

npm WARN using --force Recommended protections disabled.

npm WARN audit Updating electron to 28.1.4, which is a SemVer major change.

added 10 packages, removed 13 packages, changed 15 packages, and audited 555 packages in 4s

76 packages are looking for funding

  run `npm fund` for details

# npm audit report

minimatch  <3.0.5

Severity: high

minimatch ReDoS vulnerability - https://github.com/advisories/GHSA-f8q6-p94x-37v3

fix available via `npm audit fix`

node_modules/dir-compare/node_modules/minimatch

  dir-compare  <=2.4.0

  Depends on vulnerable versions of minimatch

  node_modules/dir-compare

    @electron/universal  1.0.1 - 1.3.3

    Depends on vulnerable versions of dir-compare

    node_modules/@electron/universal

      app-builder-lib  22.10.4 - 24.0.0-alpha.13

      Depends on vulnerable versions of @electron/universal

      node_modules/app-builder-lib

        dmg-builder  22.10.4 - 24.0.0-alpha.13

        Depends on vulnerable versions of app-builder-lib

        node_modules/dmg-builder

          electron-builder  19.25.0 || 22.10.4 - 24.6.0

          Depends on vulnerable versions of app-builder-lib

          Depends on vulnerable versions of dmg-builder

          Depends on vulnerable versions of simple-update-notifier

          node_modules/electron-builder

semver  7.0.0 - 7.5.1

Severity: moderate

semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw

fix available via `npm audit fix`

node_modules/simple-update-notifier/node_modules/semver

  simple-update-notifier  1.0.7 - 1.1.0

  Depends on vulnerable versions of semver

  node_modules/simple-update-notifier

8 vulnerabilities (2 moderate, 6 high)

To address all issues, run:

  npm audit fix

% git diff

diff --git a/package.json b/package.json

index f470e2b..4b7ac3d 100644

--- a/package.json

+++ b/package.json

@@ -19,7 +19,7 @@

     "concurrently": "^7.4.0",

     "copy-webpack-plugin": "^11.0.0",

     "cross-env": "^7.0.3",

-    "electron": "^20.1.1",

+    "electron": "^28.1.4",

     "electron-builder": "^23.3.3",

     "webpack-cli": "^4.10.0",

     "webpack-dev-server": "^4.11.0"

這樣應當算有處理到一個項目的更新，最後再看看之前的 build code 是否正常

% npm install

% npm run build

> simple-electron-app@1.0.0 build

> webpack-cli && electron-builder -mwl

assets by path ../../ 2.47 KiB

  assets by path ../../renderer/*.js 958 bytes

    asset ../../renderer/mainRenederer.js 910 bytes [emitted] [from: src/renderer/mainRenederer.js] [copied] [minimized]

    asset ../../renderer/index.js 48 bytes [emitted] [from: src/renderer/index.js] [copied] [minimized]

  asset ../../main/index.js 1.26 KiB [emitted] [from: src/main/index.js] [copied] [minimized]

  asset ../../preload/mainRenderer.js 289 bytes [emitted] [from: src/preload/mainRenderer.js] [copied] [minimized]

asset index.html 495 bytes [emitted] [from: src/html/mainRenderer/index.html] [copied]

asset index.js 253 bytes [emitted] [minimized] (name: mainRendererHTML)

./src/html/mainRenderer/index.js 380 bytes [built] [code generated]

WARNING in configuration

The 'mode' option has not been set, webpack will fallback to 'production' for this value.

Set 'mode' option to 'development' or 'production' to enable defaults for each environment.

You can also set it to 'none' to disable any default behavior. Learn more: https://webpack.js.org/configuration/mode/

webpack 5.89.0 compiled with 1 warning in 146 ms

  • electron-builder  version=23.6.0 os=23.2.0

  • description is missed in the package.json  appPackageFile=/Volumes/Data/UserData/tmp/node-electron-based/package.json

  • writing effective config  file=dist/builder-effective-config.yaml

  • packaging       platform=darwin arch=arm64 electron=28.1.4 appOutDir=dist/mac-arm64

  • downloading     url=https://github.com/electron/electron/releases/download/v28.1.4/electron-v28.1.4-darwin-arm64.zip size=95 MB parts=8

  • downloaded      url=https://github.com/electron/electron/releases/download/v28.1.4/electron-v28.1.4-darwin-arm64.zip duration=36.971s

  • default Electron icon is used  reason=application icon is not set

  • skipped macOS application code signing  reason=cannot find valid "Developer ID Application" identity or custom non-Apple code signing certificate, it could cause some undefined behaviour, e.g. macOS localized description not visible, see https://electron.build/code-signing allIdentities=     0 identities found

                                                Valid identities only

     0 valid identities found

  • building        target=macOS zip arch=arm64 file=dist/simple-electron-app-1.0.0-arm64-mac.zip

  • building        target=DMG arch=arm64 file=dist/simple-electron-app-1.0.0-arm64.dmg

  • Detected arm64 process, HFS+ is unavailable. Creating dmg with APFS - supports Mac OSX 10.12+

  • packaging       platform=linux arch=x64 electron=28.1.4 appOutDir=dist/linux-unpacked

  • downloading     url=https://github.com/electron/electron/releases/download/v28.1.4/electron-v28.1.4-linux-x64.zip size=102 MB parts=8

  • building block map  blockMapFile=dist/simple-electron-app-1.0.0-arm64.dmg.blockmap

  • building block map  blockMapFile=dist/simple-electron-app-1.0.0-arm64-mac.zip.blockmap

  • downloaded      url=https://github.com/electron/electron/releases/download/v28.1.4/electron-v28.1.4-linux-x64.zip duration=30.749s

  • building        target=snap arch=x64 file=dist/simple-electron-app_1.0.0_amd64.snap

  • building        target=AppImage arch=x64 file=dist/simple-electron-app-1.0.0.AppImage

  • application Linux category is set to default "Utility"  reason=linux.category is not set and cannot map from macOS docs=https://www.electron.build/configuration/linux

  • default Electron icon is used  reason=application icon is not set

  • application Linux category is set to default "Utility"  reason=linux.category is not set and cannot map from macOS docs=https://www.electron.build/configuration/linux

  • packaging       platform=win32 arch=arm64 electron=28.1.4 appOutDir=dist/win-arm64-unpacked

  • downloading     url=https://github.com/electron/electron/releases/download/v28.1.4/electron-v28.1.4-win32-arm64.zip size=108 MB parts=8

  • downloading     url=https://github.com/electron-userland/electron-builder-binaries/releases/download/snap-template-4.0-2/snap-template-electron-4.0-2-amd64.tar.7z size=1.5 MB parts=1

  • downloading     url=https://github.com/electron-userland/electron-builder-binaries/releases/download/appimage-12.0.1/appimage-12.0.1.7z size=1.6 MB parts=1

  • downloaded      url=https://github.com/electron-userland/electron-builder-binaries/releases/download/appimage-12.0.1/appimage-12.0.1.7z duration=5.225s

  • downloaded      url=https://github.com/electron-userland/electron-builder-binaries/releases/download/snap-template-4.0-2/snap-template-electron-4.0-2-amd64.tar.7z duration=5.425s

  • downloaded      url=https://github.com/electron/electron/releases/download/v28.1.4/electron-v28.1.4-win32-arm64.zip duration=42.26s

  • default Electron icon is used  reason=application icon is not set

  • downloading     url=https://github.com/electron-userland/electron-builder-binaries/releases/download/winCodeSign-2.6.0/winCodeSign-2.6.0.7z size=5.6 MB parts=1

  • downloaded      url=https://github.com/electron-userland/electron-builder-binaries/releases/download/winCodeSign-2.6.0/winCodeSign-2.6.0.7z duration=4.001s

  • downloading     url=https://github.com/electron-userland/electron-builder-binaries/releases/download/wine-4.0.1-mac/wine-4.0.1-mac.7z size=19 MB parts=3

  • downloaded      url=https://github.com/electron-userland/electron-builder-binaries/releases/download/wine-4.0.1-mac/wine-4.0.1-mac.7z duration=13.249s

  • building        target=nsis file=dist/simple-electron-app Setup 1.0.0.exe archs=arm64 oneClick=true perMachine=false

  • downloading     url=https://github.com/electron-userland/electron-builder-binaries/releases/download/nsis-3.0.4.1/nsis-3.0.4.1.7z size=1.3 MB parts=1

  • downloaded      url=https://github.com/electron-userland/electron-builder-binaries/releases/download/nsis-3.0.4.1/nsis-3.0.4.1.7z duration=5.637s

  • downloading     url=https://github.com/electron-userland/electron-builder-binaries/releases/download/nsis-resources-3.4.1/nsis-resources-3.4.1.7z size=731 kB parts=1

  • downloaded      url=https://github.com/electron-userland/electron-builder-binaries/releases/download/nsis-resources-3.4.1/nsis-resources-3.4.1.7z duration=4.013s

  • building block map  blockMapFile=dist/simple-electron-app Setup 1.0.0.exe.blockmap

編譯正常，接下來再繼續處理 

% npm audit fix

up to date, audited 555 packages in 730ms

76 packages are looking for funding

  run `npm fund` for details

# npm audit report

minimatch  <3.0.5

Severity: high

minimatch ReDoS vulnerability - https://github.com/advisories/GHSA-f8q6-p94x-37v3

fix available via `npm audit fix`

node_modules/dir-compare/node_modules/minimatch

  dir-compare  <=2.4.0

  Depends on vulnerable versions of minimatch

  node_modules/dir-compare

    @electron/universal  1.0.1 - 1.3.3

    Depends on vulnerable versions of dir-compare

    node_modules/@electron/universal

      app-builder-lib  22.10.4 - 24.0.0-alpha.13

      Depends on vulnerable versions of @electron/universal

      node_modules/app-builder-lib

        dmg-builder  22.10.4 - 24.0.0-alpha.13

        Depends on vulnerable versions of app-builder-lib

        node_modules/dmg-builder

          electron-builder  19.25.0 || 22.10.4 - 24.6.0

          Depends on vulnerable versions of app-builder-lib

          Depends on vulnerable versions of dmg-builder

          Depends on vulnerable versions of simple-update-notifier

          node_modules/electron-builder

semver  7.0.0 - 7.5.1

Severity: moderate

semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw

fix available via `npm audit fix`

node_modules/simple-update-notifier/node_modules/semver

  simple-update-notifier  1.0.7 - 1.1.0

  Depends on vulnerable versions of semver

  node_modules/simple-update-notifier

8 vulnerabilities (2 moderate, 6 high)

To address all issues, run:

  npm audit fix

故事大概起源於 electron-builder ，只好先把他升級看看

% cat package.json | jq '.devDependencies["electron-builder"]'

"^23.3.3"

% npm update --dev electron-builder

% cat package.json | jq '.devDependencies["electron-builder"]'

"^23.3.3"

看來只好靠這招了：

% npm install electron-builder@latest --save-dev

% cat package.json | jq '.devDependencies["electron-builder"]'

"^24.9.1"

如此也確認都沒事了：

% npm audit

found 0 vulnerabilities

最終，其實也只是改 package.json 兩行 XD

% git diff package.json 

diff --git a/package.json b/package.json

index f470e2b..4c830f1 100644

--- a/package.json

+++ b/package.json

@@ -19,8 +19,8 @@

     "concurrently": "^7.4.0",

     "copy-webpack-plugin": "^11.0.0",

     "cross-env": "^7.0.3",

-    "electron": "^20.1.1",

-    "electron-builder": "^23.3.3",

+    "electron": "^28.1.4",

+    "electron-builder": "^24.9.1",

     "webpack-cli": "^4.10.0",

     "webpack-dev-server": "^4.11.0"

   }

[Linux] 修復 Ubuntu 12.04 無法安裝軟體 - W: Failed to fetch 404 @ Ubuntu 12.04

老機器環境：

$ lsb_release -a

No LSB modules are available.

Distributor ID: Ubuntu

Description: Ubuntu 12.04.5 LTS

Release: 12.04

Codename: precise

主要是在 server 運行 apt-get update 時，會出現一堆 404 問題：

W: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/precise-backports/multiverse/binary-i386/Packages 404

追了一下應當是 12.04 已經不維護了。運氣不錯，有找到 old-releases.ubuntu.com 位置：

• https://archive.ubuntu.com/ubuntu/
• https://old-releases.ubuntu.com/ubuntu/

接著就動手換掉 /etc/apt/sources.lis 即可，包括來源 server 換完後，記得要再把 /var/lib/apt/lists 先移除：

$ sudo mv /var/lib/apt/lists /var/lib/apt/lists-backup

$ sudo mkdir -p /var/lib/apt/lists

$ sudo apt-get update

如此就會修復相關資訊，可以在靠 apt-get 安裝軟體了。

此外，若剛好在除錯時，刪除了已安裝過的軟體，接著做了上述後，又要安裝時，會碰到資訊對不上的問題，如：

dpkg：error processing package XXX (--configure):

subprocess installed post-installation script returned error exit status 10

解法就是清除 /var/lib/dpkg/info/ 下相關套件的資料後，重新安裝或是跑完後續流程：

$ sudo mkdir /var/lib/dpkg/info/backup
$ sudo mv /var/lib/dpkg/info/XXX* /var/lib/dpkg/info/backup/
$ sudo apt-get install -f

Android 開發筆記 - 從 Java 端傳遞 HashMap 物件 Android NDK/ JNI C/C++ 操作變更內容

C/C++ Code:

#include <jni.h>

extern "C" {

jobject Java_YourPackageName_updateHashMap(JNIEnv *env, jobject thiz, jobject hashmap) {
    if (!hashmap)
        return hashmap;

    jclass mapClass = env->GetObjectClass(hashmap);
    jmethodID obj_put = env->GetMethodID(mapClass, "put", "(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;");

    if (mapClass && obj_put) {
        jstring key = env->NewStringUTF("Haha");
        jstring value = env->NewStringUTF("Hehe");
        env->CallObjectMethod(hashmap, obj_put, key, value);
        env->DeleteLocalRef(key);
        env->DeleteLocalRef(value);
    }

    return hashmap;
}
}

Android Java code:

public native HashMap updateHashMap(HashMap<String, String>map);
static {
        System.loadLibrary("native");
}

void usage() {
HashMap<String, String> mHashMap = new HashMap<String, String>();

        Log.d(tag, "HashMap size: "+mHashMap.size());
updateHashMap(mHashMap);
        Log.d(tag, "HashMap size: "+mHashMap.size());

        Iterator it = mHashMap.entrySet().iterator();
        while (it.hasNext()) {
            Map.Entry pair = (Map.Entry)it.next();
            Log.d(tag, "HashMap key: ["+pair.getKey()+"], value: ["+pair.getValue().toString()+"]");
        }
}

Ansible 筆記 - 讓 Server 主動更新的方式

這陣子使用 Ansible 進行大部分的機器發佈，也進入了另一個瓶頸：如何讓 Server 自動啟動後也能更新至最新版。我把它當作 Server 主動更新的流程。

目前搭配 Jenkins + git，可以定期追蹤是否要出新版，一旦決定出新版後，就是一道道 Ansible 指令執行完成發佈。在架設 AWS Auto Scaling 時，將碰到服務量變大時，將會自動開啟機器，此時這個機器狀態是有機會是過時的，這時需要讓這些機器開啟啟動時進行軟體更新，來確保得到的資料是最新的。

透過 Dynamic Inventory 架構，仿造 AWS EC2 External Inventory Script 來執行，動態塞 host 資訊給 Ansible 即可，例如：

$ cat bin/echo.sh
#!/bin/bash
echo "{\"$HOST\":$DATA}"

$ HOST=target DATA=[\"server_ip1\",\"server_ip2\"] bash bin/echo.sh                                                
{"target":["server_ip1","server_ip2"]}

$ ANSIBLE_HOST_KEY_CHECKING=false HOST=webserver DATA=[\"localhost\",\"127.0.0.1\"] ansible webserver -i bin/echo.sh -m raw -a date -k
SSH password:
127.0.0.1 | success | rc=0 >>
Thu Nov 25 11:23:26 UTC 2015


localhost | success | rc=0 >>
Thu Nov 25 11:23:26 UTC 2015

因此，整個設計架構就是讓 servers 帶足資訊到發動 Deploy(ansible commands) server 請他更新自己即可！

[SQL] 透過 INNER JOIN 更新 Table 新增的欄位數值 @ MySQL 5.6

對於一些當作收集 log 用途的 table tb_log ，隨著時間增加後，通常會再整理另一個 tb_status 的 table，快速查詢各個狀態，設計上就會定期批次從 tb_log 取出資料，存進 tb_status 中。

假設 tb_log 有 5 個欄位，一開始只覺得需要 2 個欄位的資訊，就把 tb_status 設定為 2 個欄位，然而過一陣子後，想多記錄一個欄位時，只好變動 tb_status ，但新增的欄位沒有舊資料，就變成要從 tb_log 取出來再存進 tb_status 了

碰到這種問題，有一個解法就是使用 INNER JOIN 來處理：

1. 先從 tb_status 找出欄位未有值的資料
2. 從 tb_log 組出 tb_status 所需的資料
3. 透過  Update 指令更新

情況敘述：

mysql> describe tb_log;
+--------+--------------+------+-----+---------+----------------+
| Field  | Type         | Null | Key | Default | Extra          |
+--------+--------------+------+-----+---------+----------------+
| f0     | int(11)      | NO   | PRI | NULL    | auto_increment |
| f1     | varchar(8)   | YES  |     | NULL    |                |
| f2     | varchar(8)   | YES  |     | NULL    |                |
| f3     | varchar(8)   | YES  |     | NULL    |                |
| f4     | varchar(8)   | YES  |     | NULL    |                |
+--------+--------------+------+-----+---------+----------------+

mysql> describe tb_status;
+--------+--------------+------+-----+---------+----------------+
| Field  | Type         | Null | Key | Default | Extra          |
+--------+--------------+------+-----+---------+----------------+
| f1     | varchar(8)   | YES  | PRI | NULL    |                |
| f2     | varchar(8)   | YES  |     | NULL    |                |
| f3     | varchar(8)   | YES  |     | NULL    |                |
+--------+--------------+------+-----+---------+----------------+

其中 tb_status.f3 則是新建出來，未有資料的。

第一步：先找出 tb_status.f3 是空的（新進資料會有 f3 數值，只有舊資料沒有）

mysql> SELECT f1 WHERE f3 IS NULL;

第二步：從 tb_log 組出 f3 資料，由於 tb_log 是流水帳，且 tb_status 本身也可以從 tb_log 查詢出來的，只需組出 tb_status 需要的欄位即可：

mysql> SELECT f1, f3 FROM tb_log GROUP BY f1;

第三步，把上述兩個資料 JOIN 起來：

SELECT tb1.f1, tb2.f3 FROM
( SELECT f1 WHERE f3 IS NULL ) AS tb1, (SELECT f1, f3 FROM tb_log GROUP BY f1) AS tb2
WHERE tb1.f1 = tb2.f2;

最後，追加更新 tb_status 的用法：

UPDATE tb_status AS tb4
INNER JOIN

(
SELECT tb1.f1, tb2.f3 FROM
( SELECT f1 WHERE f3 IS NULL ) AS tb1,
(SELECT f1, f3 FROM tb_log GROUP BY f1) AS tb2
WHERE tb1.f1 = tb2.f2
) AS tb3

ON tb4.f1 = tb3.f1

SET

tb4.f3 = tb3.f3;

Android 開發筆記 - 透過 Eclipse 新增 Android Project 時，勾選 Create Activity 卻沒自動建立

這個問題以前沒碰過，但類似的現象則有碰過，記得以前碰到時也是想到去看看 Eclipse 有沒更新，我是下載套裝軟體 (ADT Bundle for Mac)，但一直新都沒東西 Orz

後來直接再加入 https://dl-ssl.google.com/android/eclipse/ 來使用，就終於有更新了，更新後的確也解決了。

只是追了一下，在 ADT Bundle for Mac -> Eclipse -> Help -> Install New Software -> Available Software Sites 中，其實有 Android Developer Tools Update Site (http://dl-ssl.google.com/android/eclipse/)。

但...我已經更新好了，就沒法手動更新看看，或是只要把 http 改成 https 也能解決？！

[SQL] MySQL: Insert or update @ Ubuntu 12.04

最近把玩 MySQL 了一下，想要做一些 daily result snapshot 的部分，想說就把結果存到一張表中使用，這樣下去就真的變成純玩 SQL 的生活了 XD

此時就會碰到把新增及更新的需求，好家在 MySQL 真威，筆記一下：

http://dev.mysql.com/doc/refman/5.1/en/insert-on-duplicate.html

mysql> INSERT INTO TableName ( Filed1, Filed2 ) VALUES ( 'Value1', 'Value2' ) ON DUPLICATE KEY UPDATE Field1=VALUES(Field1);

不過這次玩的比較多一點：

mysql> INSERT INTO TableName ( Filed1, Filed2 ) 

 SELECT Field1, Field2 FROM TableName2 

 ON DUPLICATE KEY UPDATE Field1=VALUES(Field1);