From 186abbe88d474228b525e2a9c9c5c6e07d2a9e6e Mon Sep 17 00:00:00 2001 From: scottmk Date: Thu, 10 Jun 2010 18:57:14 +0000 Subject: [PATCH] When building string literals in SQL: escape special characters. M Open-ILS/src/c-apps/buildSQL.c git-svn-id: svn://svn.open-ils.org/ILS/trunk@16658 dcc99617-32d9-48b4-a31d-7c20da2025e4 --- Open-ILS/src/c-apps/buildSQL.c | 30 ++++++++++++++++++++++-------- 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/Open-ILS/src/c-apps/buildSQL.c b/Open-ILS/src/c-apps/buildSQL.c index 15cc46c552..032dafa6db 100644 --- a/Open-ILS/src/c-apps/buildSQL.c +++ b/Open-ILS/src/c-apps/buildSQL.c @@ -832,10 +832,17 @@ static void buildExpression( BuildSQLState* state, const Expression* expr ) { "Internal error: No string value in string expression # %d", expr->id )); state->error = 1; } else { - // To do: escape special characters in the string - buffer_add_char( state->sql, '\'' ); - buffer_add( state->sql, expr->literal ); - buffer_add_char( state->sql, '\'' ); + char* str = strdup( expr->literal ); + dbi_conn_quote_string( state->dbhandle, &str ); + if( str ) { + buffer_add( state->sql, str ); + free( str ); + } else { + osrfLogWarning( OSRF_LOG_MARK, sqlAddMsg( state, + "Unable to format string literal \"%s\" for expression # %d", + expr->literal, expr->id )); + state->error = 1; + } } break; case EXP_SUBQUERY : @@ -1037,10 +1044,17 @@ static void buildScalar( BuildSQLState* state, int numeric, const jsonObject* ob "Invalid value for bind variable: expected a string, found a number" ); state->error = 1; } else { - // To do: escape special characters in the string - buffer_add_char( state->sql, '\'' ); - buffer_add( state->sql, jsonObjectGetString( obj )); - buffer_add_char( state->sql, '\'' ); + char* str = jsonObjectToSimpleString( obj ); + dbi_conn_quote_string( state->dbhandle, &str ); + if( str ) { + buffer_add( state->sql, str ); + free( str ); + } else { + osrfLogWarning( OSRF_LOG_MARK, sqlAddMsg( state, + "Unable to format string literal \"%s\" for bind variable", + jsonObjectGetString( obj ))); + state->error = 1; + } } break; case JSON_NUMBER : -- 2.43.2