FreeTDS Development Group

["Brian Bruns" <camber AT ais.org>]

not much to it really.  The biggest problem is do you have the buffer
space big enough to handle the escaped string, here's a quick and dirty
implementation, calling program is responsible for free()ing the string
when done.  The API's don't really do much of anything with the SQL, they
just take it directly from the application and pass it on to the server
without processing, so I suppose that is why nothing is there.

char *escape_string(char *instr)
{
char *outstr;
int i, j=0, need = 0;

   for (i=0;i<strlen(instr);i++)
      if (instr[i]=='\'') need++;

   outstr = malloc(strlen(outstr) + need + 1);

   for (i=0;i<strlen(instr);i++) {
     if (instr[i]=='\'') {
        outstr[j++]='\'';
     outstr[j++]=instr[i];
   }
   return outstr;
}


This of course assumes that you are using single quotes for string
literals.  Sybase allows use of double quotes if quoted_indentifier is set
to off (which it is by default) but it's non-portable and make break in
the future (jConnect turns it off on connect for instance).

Brian

> Hi,
> 
> I have looked through the sybase and microsoft docs (and the FreeTDS ones)
> and I cannot find any 'standard' escape string function (i.e. to remove
> apostraphes and quotes from within a query string).
> 
> Does FreeTDS include such a function (like the mysql one) or what way do
> people usually do this in C/C++ to ensure valid query strings are entered? I
> have done this in PHP but I need a C way of doing it.
> 
> Cheers
> 
> Phil