FreeTDS Development Group

[Michael Peppler <mpeppler AT peppler.org>]

DBlib has dbsafestr().

Also you should allow escaping of both single and double quotes to be
complete.

Michael

On Thu, 2002-07-11 at 08:01, Brian Bruns wrote:
> not much to it really.  The biggest problem is do you have the buffer
> space big enough to handle the escaped string, here's a quick and dirty
> implementation, calling program is responsible for free()ing the string
> when done.  The API's don't really do much of anything with the SQL, they
> just take it directly from the application and pass it on to the server
> without processing, so I suppose that is why nothing is there.
> 
> char *escape_string(char *instr)
> {
> char *outstr;
> int i, j=0, need = 0;
> 
>    for (i=0;i<strlen(instr);i++)
>       if (instr[i]=='\'') need++;
> 
>    outstr = malloc(strlen(outstr) + need + 1);
> 
>    for (i=0;i<strlen(instr);i++) {
>      if (instr[i]=='\'') {
>         outstr[j++]='\'';
>      outstr[j++]=instr[i];
>    }
>    return outstr;
> }
> 
> 
> This of course assumes that you are using single quotes for string
> literals.  Sybase allows use of double quotes if quoted_indentifier is set
> to off (which it is by default) but it's non-portable and make break in
> the future (jConnect turns it off on connect for instance).
> 
> Brian
> 
> > Hi,
> > 
> > I have looked through the sybase and microsoft docs (and the FreeTDS ones)
> > and I cannot find any 'standard' escape string function (i.e. to remove
> > apostraphes and quotes from within a query string).
> > 
> > Does FreeTDS include such a function (like the mysql one) or what way do
> > people usually do this in C/C++ to ensure valid query strings are 
> > entered? I
> > have done this in PHP but I need a C way of doing it.
> > 
> > Cheers
> > 
> > Phil
> 
> ---
> You are currently subscribed to freetds as: [mpeppler AT peppler.org]
> To unsubscribe, forward this message to 
> leave-freetds-91463H AT franklin.oit.unc.edu
-- 
Michael Peppler / mpeppler AT peppler.org / http://www.mbay.net/~mpeppler
mpeppler AT zetatools.com / ZetaTools, Inc / http://www.zetatools.com
ZetaTools: Call perl functions as Sybase stored procedures!

Attachment: signature.asc
Description: This is a digitally signed message part