dbe998fb4fcbff1af818ccff6c970b54def2648a
galt
  Tue Jun 18 11:46:13 2013 -0700
found sql code that needed protection against sql injection
diff --git src/hg/lib/annoStreamDb.c src/hg/lib/annoStreamDb.c
index da358ce..cef93b4 100644
--- src/hg/lib/annoStreamDb.c
+++ src/hg/lib/annoStreamDb.c
@@ -123,46 +123,46 @@
     if (minChrom && differentString(minChrom, streamer->chrom))
 	errAbort("annoStreamDb %s: nextRow minChrom='%s' but region chrom='%s'",
 		 streamer->name, minChrom, streamer->chrom);
     if (self->hasBin)
 	{
 	// Results will be in bin order, but we can restore chromStart order by
 	// accumulating initial coarse-bin items and merge-sorting them with
 	// subsequent finest-bin items which will be in chromStart order.
 	resetMergeState(self);
 	self->mergeBins = TRUE;
 	self->qLm = lmInit(0);
 	}
     if (self->endFieldIndexName != NULL)
 	// Don't let mysql use a (chrom, chromEnd) index because that messes up
 	// sorting by chromStart.
-	dyStringPrintf(query, " IGNORE INDEX (%s)", self->endFieldIndexName);
-    dyStringPrintf(query, " where %s='%s'", self->chromField, streamer->chrom);
+	sqlDyStringPrintf(query, " IGNORE INDEX (%s)", self->endFieldIndexName);
+    sqlDyStringPrintf(query, " where %s='%s'", self->chromField, streamer->chrom);
     int chromSize = annoAssemblySeqSize(streamer->assembly, streamer->chrom);
     if (streamer->regionStart != 0 || streamer->regionEnd != chromSize)
 	{
 	dyStringAppend(query, " and ");
 	if (self->hasBin)
 	    hAddBinToQuery(streamer->regionStart, streamer->regionEnd, query);
-	dyStringPrintf(query, "%s < %u and %s > %u", self->startField, streamer->regionEnd,
+	sqlDyStringPrintf(query, "%s < %u and %s > %u", self->startField, streamer->regionEnd,
 		       self->endField, streamer->regionStart);
 	}
     if (self->notSorted)
-	dyStringPrintf(query, " order by %s", self->startField);
+	sqlDyStringPrintf(query, " order by %s", self->startField);
     }
 else if (self->notSorted)
-    dyStringPrintf(query, " order by %s,%s", self->chromField, self->startField);
+    sqlDyStringPrintf(query, " order by %s,%s", self->chromField, self->startField);
 if (self->maxOutRows > 0)
     dyStringPrintf(query, " limit %d", self->maxOutRows);
 struct sqlResult *sr = sqlGetResult(self->conn, query->string);
 dyStringFree(&query);
 self->sr = sr;
 }
 
 static void rowBufInit(struct rowBuf *rowBuf, int size)
 /* Clean up rowBuf and give it a new lm and buffer[size]. */
 {
 resetRowBuf(rowBuf);
 rowBuf->lm = lmInit(0);
 rowBuf->size = size;
 lmAllocArray(rowBuf->lm, rowBuf->buf, size);
 }
@@ -253,55 +253,55 @@
     queryMaxItems = self->maxOutRows;
 if (self->hasBin)
     {
     // Results will be in bin order, but we can restore chromStart order by
     // accumulating initial coarse-bin items and merge-sorting them with
     // subsequent finest-bin items which will be in chromStart order.
     if (self->doNextChunk && self->mergeBins && !self->gotFinestBin)
 	errAbort("annoStreamDb can't continue merge in chunking query; increase ASD_CHUNK_SIZE");
     self->mergeBins = TRUE;
     if (self->qLm == NULL)
 	self->qLm = lmInit(0);
     }
 if (self->endFieldIndexName != NULL)
     // Don't let mysql use a (chrom, chromEnd) index because that messes up
     // sorting by chromStart.
-    dyStringPrintf(query, "IGNORE INDEX (%s) ", self->endFieldIndexName);
+    sqlDyStringPrintf(query, "IGNORE INDEX (%s) ", self->endFieldIndexName);
 if (sSelf->chrom != NULL)
     {
     uint start = sSelf->regionStart;
     if (minChrom)
 	{
 	if (differentString(minChrom, sSelf->chrom))
 	    errAbort("annoStreamDb %s: nextRow minChrom='%s' but region chrom='%s'",
 		     sSelf->name, minChrom, sSelf->chrom);
 	if (start < minEnd)
 	    start = minEnd;
 	}
     if (self->doNextChunk && start < self->nextChunkStart)
 	start = self->nextChunkStart;
-    dyStringPrintf(query, "where %s = '%s' and ", self->chromField, sSelf->chrom);
+    sqlDyStringPrintf(query, "where %s = '%s' and ", self->chromField, sSelf->chrom);
     if (self->hasBin)
 	{
 	if (self->doNextChunk && self->gotFinestBin)
 	    // It would be way more elegant to make a hAddBinTopLevelOnly but this will do:
 	    dyStringPrintf(query, "bin > %d and ", self->minFinestBin);
 	hAddBinToQuery(start, sSelf->regionEnd, query);
 	}
     if (self->doNextChunk)
-	dyStringPrintf(query, "%s >= %u and ", self->startField, self->nextChunkStart);
-    dyStringPrintf(query, "%s < %u and %s > %u limit %d", self->startField, sSelf->regionEnd,
+	sqlDyStringPrintf(query, "%s >= %u and ", self->startField, self->nextChunkStart);
+    sqlDyStringPrintf(query, "%s < %u and %s > %u limit %d", self->startField, sSelf->regionEnd,
 		   self->endField, start, queryMaxItems);
     bufferRowsFromSqlQuery(self, query->string, queryMaxItems);
     }
 else
     {
     // Genome-wide query: break it into chrom-by-chrom queries.
     if (self->queryChrom == NULL)
 	self->queryChrom = self->chromList;
     else if (!self->doNextChunk)
 	self->queryChrom = self->queryChrom->next;
     if (minChrom != NULL)
 	{
 	// Skip chroms that precede minChrom
 	while (self->queryChrom != NULL && strcmp(self->queryChrom->name, minChrom) < 0)
 	    {
@@ -315,45 +315,45 @@
 	    if (self->qLm == NULL)
 		self->qLm = lmInit(0);
 	    }
 	}
     if (self->queryChrom == NULL)
 	self->eof = TRUE;
     else
 	{
 	char *chrom = self->queryChrom->name;
 	int start = 0;
 	if (minChrom != NULL && sameString(chrom, minChrom))
 	    start = minEnd;
 	if (self->doNextChunk && start < self->nextChunkStart)
 	    start = self->nextChunkStart;
 	uint end = annoAssemblySeqSize(self->streamer.assembly, self->queryChrom->name);
-	dyStringPrintf(query, "where %s = '%s' ", self->chromField, chrom);
+	sqlDyStringPrintf(query, "where %s = '%s' ", self->chromField, chrom);
 	if (start > 0 || self->doNextChunk)
 	    {
 	    dyStringAppend(query, "and ");
 	    if (self->hasBin)
 		{
 		if (self->doNextChunk && self->gotFinestBin)
 		    // It would be way more elegant to make a hAddBinTopLevelOnly but this will do:
 		    dyStringPrintf(query, "bin > %d and ", self->minFinestBin);
 		hAddBinToQuery(start, end, query);
 		}
 	    if (self->doNextChunk)
-		dyStringPrintf(query, "%s >= %u and ", self->startField, self->nextChunkStart);
+		sqlDyStringPrintf(query, "%s >= %u and ", self->startField, self->nextChunkStart);
 	    // region end is chromSize, so no need to constrain startField here:
-	    dyStringPrintf(query, "%s > %u ", self->endField, start);
+	    sqlDyStringPrintf(query, "%s > %u ", self->endField, start);
 	    }
 	dyStringPrintf(query, "limit %d", queryMaxItems);
 	bufferRowsFromSqlQuery(self, query->string, queryMaxItems);
 	// If there happens to be no items on chrom, try again with the next chrom:
 	if (! self->eof && self->rowBuf.size == 0)
 	    asdDoQueryChunking(self, minChrom, minEnd);
 	}
     }
 dyStringFree(&query);
 }
 
 static char **nextRowFromBuffer(struct annoStreamDb *self, char *minChrom, uint minEnd)
 /* Instead of streaming directly from self->sr, we have buffered up the results
  * of a chunked query; return the head of that queue. */
 {