escape string

[V1RUS]

i have a console program.

Code: Select all

uses
  ZConnection,ZQuery;
var
  Connection : TZConnection;
  Dataset : TZQuery;
  login : string;
begin
  Connection := TZConnection.Create(nil);
  Dataset := TZQuery.Create(nil);
  Dataset.Connection := fConnection;
  Dataset.ReadOnly := FALSE;
  Connection.Protocol := 'mysql-5'; //actually it's getting from config
  Connection.HostName        := MainProc.DatabaseOptions.RealmHost;
  Connection.Port            := MainProc.DatabaseOptions.RealmPort;
  Connection.Database        := MainProc.DatabaseOptions.RealmDB;
  Connection.User            := MainProc.DatabaseOptions.RealmUser;
  Connection.Password        := MainProc.DatabaseOptions.RealmPass;
  Connection.Connect;

  login := GetLogin; //function takes username from Edit box

  //i need to escape string(login) now to avoid hack/crash. but how ???

  //something sql-requests with this login

  Connection.Disconnect;
  Dataset.Free;
  Connection.Free;
end.

thanks all

sry 4 bad English - I'm from Russia

[zippo]

Use the backslash

[V1RUS]

can you write example ?

[mdaems]

You can use EncodeCString from ZSysUtils unit.
I'm planning to add a utility function to the Connection component which escapes characters in a way the connected database likes. Some more people are asking for it. The mysql implementation would use mysql_escape_string or mysql_real_escape_string API functions. For other databases EncodeCString function will be used until somebody provides a more db specific solution.

Mark

[V1RUS]

thanks a lot. i'll wait for your change

[mdaems]

V1RUS,

If forgot I already committed the change... It's in the last Testing snapshot already. When you use another version you can check the changes using SVN (testing branch rev. 284) and apply these changes to your sources. It's not that big.

How to use it : escapedstring=Connection1.DbcConnection.EscapeString(unescapedstring)

Mark

[btrewern]

Mark,

In PostgreSQL there is the PQescapeStringConn function which I think does what you are looking for from a PostgreSQL point of view.

See here:
http://www.postgresql.org/docs/8.2/stat ... APE-STRING

Introduced in PostgreSQL 7.3.

Regards,

Ben

[mdaems]

Ben,

Can you please do the implementation? It shouldn't be too much work:
- add the plaindriver function if it's not present yet.
- override the function in the zdbcpostgresconnection.

just post your changed files or a SVN patch here.

Mark

[rjuju]

Hi.
I'm planning to switch my postgresql db to 9.1 with standard_conforming_strings to on, so I have a similar problem.

For example, while using TDBEdit with TZQuery, if I write "let's" zeos will write a query with "let\047s", which doesn't work without E before ( E'let\047s' )

Is there a solution, like a patch with the PQescapeString function to escape string ?

Thank you