080a160c7b9595d516c9c70e83689a09b60839d0
galt
  Mon Jun 3 12:16:53 2013 -0700
fix SQL Injection
diff --git src/hg/lib/liftOverChain.c src/hg/lib/liftOverChain.c
index 834d3f2..116f862 100644
--- src/hg/lib/liftOverChain.c
+++ src/hg/lib/liftOverChain.c
@@ -95,68 +95,39 @@
 while ((row = sqlNextRow(sr)) != NULL)
     {
     el = liftOverChainLoad(row);
     slAddHead(&list, el);
     }
 slReverse(&list);
 sqlFreeResult(&sr);
 return list;
 }
 
 void liftOverChainSaveToDb(struct sqlConnection *conn, struct liftOverChain *el, char *tableName, int updateSize)
 /* Save liftOverChain as a row to the table specified by tableName. 
  * As blob fields may be arbitrary size updateSize specifies the approx size
  * of a string that would contain the entire query. Arrays of native types are
  * converted to comma separated strings and loaded as such, User defined types are
- * inserted as NULL. Note that strings must be escaped to allow insertion into the database.
- * For example "autosql's features include" --> "autosql\'s features include" 
- * If worried about this use liftOverChainSaveToDbEscaped() */
+ * inserted as NULL. Strings are automatically escaped to allow insertion into the database. */
 {
 struct dyString *update = newDyString(updateSize);
-dyStringPrintf(update, "insert into %s values ( '%s','%s',%s,%g,%u,%u,'%s',%g,'%s')", 
+sqlDyStringPrintf(update, "insert into %s values ( '%s','%s',%s,%g,%u,%u,'%s',%g,'%s')", 
 	tableName,  el->fromDb,  el->toDb,  el->path,  el->minMatch,  el->minChainT,  el->minSizeQ,  el->multiple,  el->minBlocks,  el->fudgeThick);
 sqlUpdate(conn, update->string);
 freeDyString(&update);
 }
 
-void liftOverChainSaveToDbEscaped(struct sqlConnection *conn, struct liftOverChain *el, char *tableName, int updateSize)
-/* Save liftOverChain as a row to the table specified by tableName. 
- * As blob fields may be arbitrary size updateSize specifies the approx size.
- * of a string that would contain the entire query. Automatically 
- * escapes all simple strings (not arrays of string) but may be slower than liftOverChainSaveToDb().
- * For example automatically copies and converts: 
- * "autosql's features include" --> "autosql\'s features include" 
- * before inserting into database. */ 
-{
-struct dyString *update = newDyString(updateSize);
-char  *fromDb, *toDb, *path, *multiple, *fudgeThick;
-fromDb = sqlEscapeString(el->fromDb);
-toDb = sqlEscapeString(el->toDb);
-path = sqlEscapeString(el->path);
-multiple = sqlEscapeString(el->multiple);
-fudgeThick = sqlEscapeString(el->fudgeThick);
-
-dyStringPrintf(update, "insert into %s values ( '%s','%s','%s',%g,%u,%u,'%s',%g,'%s')", 
-	tableName,  fromDb,  toDb,  path, el->minMatch , el->minChainT , el->minSizeQ ,  multiple, el->minBlocks ,  fudgeThick);
-sqlUpdate(conn, update->string);
-freeDyString(&update);
-freez(&fromDb);
-freez(&toDb);
-freez(&path);
-freez(&multiple);
-freez(&fudgeThick);
-}
 
 struct liftOverChain *liftOverChainCommaIn(char **pS, struct liftOverChain *ret)
 /* Create a liftOverChain out of a comma separated string. 
  * This will fill in ret if non-null, otherwise will
  * return a new liftOverChain */
 {
 char *s = *pS;
 
 if (ret == NULL)
     AllocVar(ret);
 ret->fromDb = sqlStringComma(&s);
 ret->toDb = sqlStringComma(&s);
 ret->path = sqlStringComma(&s);
 ret->minMatch = sqlFloatComma(&s);
 ret->minChainT = sqlUnsignedComma(&s);
@@ -222,31 +193,31 @@
 fprintf(f, "%g", el->minBlocks);
 fputc(sep,f);
 if (sep == ',') fputc('"',f);
 fprintf(f, "%s", el->fudgeThick);
 if (sep == ',') fputc('"',f);
 fputc(lastSep,f);
 }
 
 /* -------------------------------- End autoSql Generated Code -------------------------------- */
 
 boolean liftOverChainExists(struct sqlConnection *conn, char *tableName,
                                 char *fromDb, char *toDb)
 /* Return TRUE if row where fromDb and toDb match */
 {
 char query[256];
-safef(query, sizeof(query), 
+sqlSafef(query, sizeof(query), 
         "select count(*) from %s where fromDb = '%s' and toDb = '%s'",
 	        tableName, fromDb, toDb);
 return sqlQuickNum(conn, query) > 0;
 }
 
 void liftOverChainRemove(struct sqlConnection *conn, char *tableName,
                                 char *fromDb, char *toDb)
 /* Remove rows where fromDb and toDb match */
 {
 char query[256];
-safef(query, sizeof(query), 
+sqlSafef(query, sizeof(query), 
         "delete from %s where fromDb = '%s' and toDb = '%s'",
 	        tableName, fromDb, toDb);
 sqlUpdate(conn, query);
 }