[geeklog-devel] MS SQL escaping

[Michael Jervis]

The right one is the one I Committed to fix issues with the installer ;-)

" does not require escaping in SQL. ' does, and is escaped as ''

Geeklog escapes " to \" then passes that in, so we need to change \"
to " in passed in SQL Strings.

On Fri, Jul 4, 2008 at 10:38, Dirk Haun <dirk at haun-online.de> wrote:
> Looking through the config class, there are 3 places where we do some
> special escaping for MS SQL.
>
> In functions set() and set_default(), we do
>
>        if ($_DB_dbms == 'mssql') {
>            $sql_query = str_replace("\\'", "''", $sql_query);
>            $sql_query = str_replace('\\"', '"', $sql_query);
>
> whereas in function add(), we do
>
>        if ($_DB_dbms == 'mssql') {
>            $sql_query = str_replace("\\'", "''", $sql_query);
>            $sql_query = str_replace('\\"', '""', $sql_query);
>
> So in the first case, \" is replaced with a single " while in the second
> case, it's replaced with two "".
>
> Am I missing something or is one of those wrong (and if so, which one's
> correct)?
>
> bye, Dirk
>
>
> --
> http://www.geeklog.net/
> http://geeklog.info/
>
> _______________________________________________
> geeklog-devel mailing list
> geeklog-devel at lists.geeklog.net
> http://eight.pairlist.net/mailman/listinfo/geeklog-devel
>



-- 
Michael Jervis
mjervis at gmail.com
504B03041400000008008F846431E3543A820800000006000000060000007765
62676F642B4F4D4ACF4F0100504B010214001400000008008F846431E3543A82
0800000006000000060000000000000000002000000000000000776562676F64
504B05060000000001000100340000002C0000000000