[UDD] Changing aux.py to fix quoting

February 04th, 2012 - 03:50 am ET by Andreas Tille | Report spam
Hi,

since I switched to PostgreSQL 9.1 I realised that quoting "'"
characters does not work any mory by escaping it using "\" signs.
I wonder, how at all aux.py could work for others. Because I have
the feeling that I missed something I'm just asking for comments
for the following patch to not break any UDD application.

So what do you think about this which is needed *at my machine running
testing*:

$ svn diff
Index: aux.py
aux.py (Revision 2135)
+++ aux.py (Arbeitskopie)
@@ -15,7 +15,7 @@
"Quote a string for SQL and encode it to UTF-8 if it is a unicode string"
if isinstance(s, unicode):
s = s.encode('utf-8')
- return "'" + s.replace("\\", "\\\\").replace("'", "\\'") + "'"
+ return "'" + s.replace("\\", "\\\\").replace("'", "''") + "'"

def null_or_quote(dict, key):
"If key is an element of dict, return it quoted. Return NULL otherwise"

Kind regards

Andreas.

http://fam-tille.de


To UNSUBSCRIBE, email to debian-qa-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: http://lists.debian.org/20120204084656.GC21962@an3as.eu
email Follow the discussionReplies 5 repliesReplies Make a reply

Replies

#1 Paul Wise
February 04th, 2012 - 04:10 am ET | Report spam
On Sat, Feb 4, 2012 at 4:46 PM, Andreas Tille wrote:

since I switched to PostgreSQL 9.1 I realised that quoting "'"
characters does not work any mory by escaping it using "\" signs.
I wonder, how at all aux.py could work for others.  Because I have
the feeling that I missed something I'm just asking for comments
for the following patch to not break any UDD application.

So what do you think about this which is needed *at my machine running
testing*:



Sounds like you want to be using prepared statements, otherwise you
risk SQL injections.

bye,
pabs

http://wiki.debian.org/PaulWise


To UNSUBSCRIBE, email to
with a subject of "unsubscribe". Trouble? Contact
Archive: http://lists.debian.org/CAKTje6HthD...zmFJzj-18=

Similar topics