psqlodbc.git / summary / log / commit / refs

commit    d7fd0d4aba0db33091a2bf140ce5efe73f2fbb7a
Author:   Heikki Linnakangas <heikki.linnakangas@iki.fi>
Date:     Tue Jan 13 21:29:48 2015 +0000

    Fix various quoting issues in sending query parameters to server.
    
    The code used to just assume that if the parameter's SQL type is SQL_INTEGER
    or SQL_SMALLINT, it doesn't need quoting. While that's true for valid
    integers values, there were no safeguards that the bound string is actually
    valid input. The server will just throw an error on invalid input, but we
    need to quote it correctly to send it to the server in the first place.
    For example, if the string "123, 'inject'" is bound to an SQL_INTEGER param,
    we need to quote it or the server will interpret it as part of the query.
    
    Also add a test case for this.
    
    Reported by Jeremy Faith.

[parent: 30dbaa0e0b92]