080a160c7b9595d516c9c70e83689a09b60839d0 galt Mon Jun 3 12:16:53 2013 -0700 fix SQL Injection diff --git src/hg/lib/hgExp.c src/hg/lib/hgExp.c index 6d60a0a..f50bfda 100644 --- src/hg/lib/hgExp.c +++ src/hg/lib/hgExp.c @@ -46,31 +46,31 @@ char query[256], nameBuf[128]; int maxLen = 0, len; if (!hTableExists(database, table)) db = "hgFixed"; conn = sqlConnect(db); /* Read into array and figure out longest name. */ AllocArray(names, expCount); for (i=0; i<expCount; ++i) { int ix = expIds[i]; if (ix == -1) names[i] = NULL; else { - safef(query, sizeof(query), "select name from %s where id = %d", + sqlSafef(query, sizeof(query), "select name from %s where id = %d", table, expIds[i]); if ((name = sqlQuickQuery(conn, query, nameBuf, sizeof(nameBuf))) == NULL) name = "unknown"; else name += skipSize; names[i] = cloneString(name); len = strlen(name); if (len > maxLen) maxLen = len; } } sqlDisconnect(&conn); /* Right justify names. */ for (i=0; i<expCount; ++i) { @@ -133,39 +133,39 @@ boolean hgExpLoadVals(struct sqlConnection *lookupConn, struct sqlConnection *dataConn, char *lookupTable, char *name, char *dataTable, int *retValCount, float **retVals) /* Load up and return expression bed record. Return NULL * if none of given name exist. */ { char query[256]; char expName[64]; struct sqlResult *sr; char **row; boolean ok = FALSE; if (!sameWord(lookupTable, "null")) { - safef(query, sizeof(query), "select value from %s where name = '%s'", + sqlSafef(query, sizeof(query), "select value from %s where name = '%s'", lookupTable, name); if (sqlQuickQuery(lookupConn, query, expName, sizeof(expName)) == NULL) return FALSE; - safef(query, sizeof(query), "select expScores from %s where name = '%s'", + sqlSafef(query, sizeof(query), "select expScores from %s where name = '%s'", dataTable, expName); } else - safef(query, sizeof(query), "select expScores from %s where name = '%s'", + sqlSafef(query, sizeof(query), "select expScores from %s where name = '%s'", dataTable, name); sr = sqlGetResult(dataConn, query); if ((row = sqlNextRow(sr)) != NULL) { sqlFloatDynamicArray(row[0], retVals, retValCount); ok = TRUE; } sqlFreeResult(&sr); return ok; } static void hexOne(double val) /* Convert val 0.0-1.0 to hex 00 to FF */ {