FreeTDS Development Group

[Marc Abramowitz <msabramo AT gmail.com>]

On Sun, Jan 5, 2014 at 11:32 AM, Frediano Ziglio <freddy77 AT gmail.com> wrote:

> The problem of your implementation is that TDSECONN is passed by
> libTDS and not all libraries add the required parameter so you can
> have a not formatted string in other libraries.
>
> Mixing normal string and string with format looks a bit security suspect
> to me.
>

Yeah, that smelled a little funny to me too.

I updated my PR so that dbperror itself appends the server_name, if
available, to the error message. So no need to pass it into dbperror.

https://gitorious.org/freetds/freetds/merge_requests/24/diffs

Hopefully, that's better.

Marc