Database Management Systems (DBMSs) provide efficient data retrieval and manipulation for many applications through Structured Query Language (SQL). Incorrect implementations can result in logic bugs, which cause a SELECT query to fetch an incorrect result, or an UPDATE / DELETE query to generate an incorrect database state. Existing approaches mainly focus on detecting logic bugs in SELECT queries. However, logic bugs in UPDATE / DELETE queries have not been tackled.

In this paper, we propose a novel and general approach, which we have termed Differential Query Execution (\emph{DQE}) to detect logic bugs in DBMSs. The core idea of DQE is that different SQL queries with the same predicate usually access the same rows in a database. For example, a row updated by an UPDATE query with a predicate $\varphi$ should also be fetched by the SELECT query with the same predicate $\varphi$. If not, a logic bug is revealed in the target DBMS. To evaluate the effectiveness and generality of DQE, we apply DQE on five production-level DBMSs, including MySQL, MariaDB, TiDB, CockroachDB and SQLite. In total, we have detected 50 unique bugs in these DBMSs, 41 of which are confirmed, and 11 have been fixed. We expect that the simplicity and generality of DQE can be widely used to improve the quality of DBMSs.