080a160c7b9595d516c9c70e83689a09b60839d0 galt Mon Jun 3 12:16:53 2013 -0700 fix SQL Injection diff --git src/hg/lib/dbSnpRs.c src/hg/lib/dbSnpRs.c index 009f7f2..5107790 100644 --- src/hg/lib/dbSnpRs.c +++ src/hg/lib/dbSnpRs.c @@ -95,72 +95,39 @@ while ((row = sqlNextRow(sr)) != NULL) { el = dbSnpRsLoad(row); slAddHead(&list, el); } slReverse(&list); sqlFreeResult(&sr); return list; } void dbSnpRsSaveToDb(struct sqlConnection *conn, struct dbSnpRs *el, char *tableName, int updateSize) /* Save dbSnpRs as a row to the table specified by tableName. * As blob fields may be arbitrary size updateSize specifies the approx size * of a string that would contain the entire query. Arrays of native types are * converted to comma separated strings and loaded as such, User defined types are - * inserted as NULL. Note that strings must be escaped to allow insertion into the database. - * For example "autosql's features include" --> "autosql\'s features include" - * If worried about this use dbSnpRsSaveToDbEscaped() */ + * inserted as NULL. Strings are automatically escaped to allow insertion into the database. */ { struct dyString *update = newDyString(updateSize); -dyStringPrintf(update, "insert into %s values ( '%s',%f,%f,'%s','%s','%s','%s','%s','%s')", +sqlDyStringPrintf(update, "insert into %s values ( '%s',%f,%f,'%s','%s','%s','%s','%s','%s')", tableName, el->rsId, el->avHet, el->avHetSE, el->valid, el->allele1, el->allele2, el->assembly, el->alternate, el->func); sqlUpdate(conn, update->string); freeDyString(&update); } -void dbSnpRsSaveToDbEscaped(struct sqlConnection *conn, struct dbSnpRs *el, char *tableName, int updateSize) -/* Save dbSnpRs as a row to the table specified by tableName. - * As blob fields may be arbitrary size updateSize specifies the approx size. - * of a string that would contain the entire query. Automatically - * escapes all simple strings (not arrays of string) but may be slower than dbSnpRsSaveToDb(). - * For example automatically copies and converts: - * "autosql's features include" --> "autosql\'s features include" - * before inserting into database. */ -{ -struct dyString *update = newDyString(updateSize); -char *rsId, *valid, *allele1, *allele2, *assembly, *alternate, *func; -rsId = sqlEscapeString(el->rsId); -valid = sqlEscapeString(el->valid); -allele1 = sqlEscapeString(el->allele1); -allele2 = sqlEscapeString(el->allele2); -assembly = sqlEscapeString(el->assembly); -alternate = sqlEscapeString(el->alternate); -func = sqlEscapeString(el->func); - -dyStringPrintf(update, "insert into %s values ( '%s',%f,%f,'%s','%s','%s','%s','%s','%s')", - tableName, rsId, el->avHet , el->avHetSE , valid, allele1, allele2, assembly, alternate, func); -sqlUpdate(conn, update->string); -freeDyString(&update); -freez(&rsId); -freez(&valid); -freez(&allele1); -freez(&allele2); -freez(&assembly); -freez(&alternate); -freez(&func); -} struct dbSnpRs *dbSnpRsCommaIn(char **pS, struct dbSnpRs *ret) /* Create a dbSnpRs out of a comma separated string. * This will fill in ret if non-null, otherwise will * return a new dbSnpRs */ { char *s = *pS; if (ret == NULL) AllocVar(ret); ret->rsId = sqlStringComma(&s); ret->avHet = sqlFloatComma(&s); ret->avHetSE = sqlFloatComma(&s); ret->valid = sqlStringComma(&s); ret->allele1 = sqlStringComma(&s);