Re: [PATCH] dlr_mysql.c needs to use mysql_escape_string() from mysql API

definitively ++1

Vincent.


Stipe Tolj a écrit :
> Hi list,
> 
> we have a possible bug situation in the gw/dlr_mysql.c module, 
> especially for the dlr_mysql_add() function:
> 
> We perform an INSERT into the table space with the values provided in 
> dlr_entry struct. The field entry->source is the source address and if 
> we used an alphanumeric value here containing any SQL "administrative 
> chars" (i.e. ') we run into an mysql error. We need to ensure that all 
> values passed from the "outside" (via smsbox HTTP interface) to the SQL 
> creation format is passed via mysql's mysql_escape_string() function, 
> ensuring such chars are escaped.
> 
> We had such a patch posted by:
> 
>   From: Peter Christensen
>   Subject: Re: dlr_mysql_add and internal charset
>   Date: Tue, 10 Jan 2006 07:44:02 -0800
>   URL: http://www.mail-archive.com/[email protected]/msg05381.html
> 
> but it was actually never applied. This is a re-write of Peter's patch, 
> making a dbpool_mysql_escape_string() wrapper function available in the 
> gwlib/dbpool_mysql.c and using it in gw/dlr_mysql.c.
> 
> Please review and vote for committing to CVS.
> 
> Stipe
> 
> -------------------------------------------------------------------
> Kölner Landstrasse 419
> 40589 Düsseldorf, NRW, Germany
> 
> tolj.org system architecture      Kannel Software Foundation (KSF)
> http://www.tolj.org/              http://www.kannel.org/
> 
> mailto:st_{at}_tolj.org           mailto:stolj_{at}_kannel.org
> -------------------------------------------------------------------
> 

-- 
Telemaque - 06560 SOPHIA-ANTIPOLIS - (FR)
Service Technique/Reseau - NOC
Direction du Developpement xMS+
http://www.telemaque.fr/
[email protected]
Tel : +33 4 92 90 99 84 (fax 9142)