080a160c7b9595d516c9c70e83689a09b60839d0
galt
  Mon Jun 3 12:16:53 2013 -0700
fix SQL Injection
diff --git src/hg/hgApi/hgApi.c src/hg/hgApi/hgApi.c
index 15b1d7d..ee0998e 100644
--- src/hg/hgApi/hgApi.c
+++ src/hg/hgApi/hgApi.c
@@ -52,33 +52,31 @@
 
 if (!strcmp(cmd, "defaultPos"))
     {
     dyStringPrintf(output, "{\"pos\": \"%s\"}", hDefaultPos(database));
     }
 else if (!strcmp(cmd, "metaDb"))
     {
     // Return list of values for given metaDb var
     // e.g. http://genome.ucsc.edu/hgApi?db=hg18&cmd=metaDb&var=cell
 
     struct sqlConnection *conn = hAllocConn(database);
     boolean metaDbExists = sqlTableExists(conn, "metaDb");
     if (metaDbExists)
         {
         char *var = cgiOptionalString("var");
-        if (var)
-            var = sqlEscapeString(var);
-        else
+        if (!var)
             errAbort("Missing var parameter");
         boolean fileSearch = (cgiOptionalInt("fileSearch",0) == 1);
         struct slPair *pairs = mdbValLabelSearch(conn, var, MDB_VAL_STD_TRUNCATION, FALSE,
                                                  !fileSearch, fileSearch);
         struct slPair *pair;
         dyStringPrintf(output, "[\n");
         for (pair = pairs; pair != NULL; pair = pair->next)
             {
             if (pair != pairs)
                 dyStringPrintf(output, ",\n");
             dyStringPrintf(output, "['%s','%s']", javaScriptLiteralEncode(mdbPairLabel(pair)),
                            javaScriptLiteralEncode(mdbPairVal(pair)));
             }
         dyStringPrintf(output, "\n]\n");
         }
@@ -87,33 +85,31 @@
     }
 // TODO: move to lib since hgTracks and hgApi share
 #define METADATA_VALUE_PREFIX    "hgt_mdbVal"
 else if (startsWith(METADATA_VALUE_PREFIX, cmd))
     {
     // Returns metaDb value control: drop down or free text, with or without help link.
     // e.g. http://genome.ucsc.edu/hgApi?db=hg18&cmd=hgt_mdbVal3&var=cell
 
     // TODO: Move guts to lib, so that hgTracks::searchTracks.c and hgApi.c can share
 
     struct sqlConnection *conn = hAllocConn(database);
     boolean metaDbExists = sqlTableExists(conn, "metaDb");
     if (metaDbExists)
         {
         char *var = cgiOptionalString("var");
-        if (var)
-            var = sqlEscapeString(var);
-        else
+        if (!var)
             errAbort("Missing var parameter");
 
         int ix = atoi(cmd+strlen(METADATA_VALUE_PREFIX)); // 1 based index
         if (ix == 0) //
             errAbort("Unsupported 'cmd' parameter");
 
         enum cvSearchable searchBy = cvSearchMethod(var);
         char name[128];
         safef(name,sizeof name,"%s%i",METADATA_VALUE_PREFIX,ix);
         if (searchBy == cvSearchBySingleSelect || searchBy == cvSearchByMultiSelect)
             {
             boolean fileSearch = (cgiOptionalInt("fileSearch",0) == 1);
             struct slPair *pairs = mdbValLabelSearch(conn, var, MDB_VAL_STD_TRUNCATION, FALSE,
                                                      !fileSearch, fileSearch);
             if (slCount(pairs) > 0)
@@ -180,31 +176,31 @@
             dyStringPrintf(output,"Track %s not found",trackName);
         }
     else
         dyStringAppend(output,"No track variable found");
     }
 else if (sameString(cmd, "codonToPos") || sameString(cmd, "exonToPos"))
     {
     char query[256];
     struct sqlResult *sr;
     char **row;
     struct genePred *gp;
     char *name = cgiString("name");
     char *table = cgiString("table");
     int num = cgiInt("num");
     struct sqlConnection *conn = hAllocConn(database);
-    safef(query, sizeof(query), "select name, chrom, strand, txStart, txEnd, cdsStart, cdsEnd, exonCount, exonStarts, exonEnds from %s where name = '%s'", sqlEscapeString(table), sqlEscapeString(name));
+    sqlSafef(query, sizeof(query), "select name, chrom, strand, txStart, txEnd, cdsStart, cdsEnd, exonCount, exonStarts, exonEnds from %s where name = '%s'", table, name);
     sr = sqlGetResult(conn, query);
     if ((row = sqlNextRow(sr)) != NULL)
         {
         gp = genePredLoad(row);
         boolean found;
         int start, end;
         if (sameString(cmd, "codonToPos"))
             found = codonToPos(gp, num, &start, &end);
         else
             found = exonToPos(gp, num, &start, &end);
         if (found)
             dyStringPrintf(output, "{\"pos\": \"%s:%d-%d\"}", gp->chrom, start + 1, end);
         else
             dyStringPrintf(output, "{\"error\": \"%d is an invalid %s for this gene\"}", num, sameString(cmd, "codonToPos") ? "codon" : "exon");
         }