83fcfc003aad68c20e56e546e75f79c63c7332d6 galt Fri Dec 14 12:36:43 2018 -0800 Simple testing shows that this gets an error when just switching from one db to another. Although it is a nice idea, it could be a lot of work to be sure nowhere in the code is using the blank identifier. So it stays in for now. diff --git src/hg/lib/jksql.c src/hg/lib/jksql.c index 7991872..a50ff98 100644 --- src/hg/lib/jksql.c +++ src/hg/lib/jksql.c @@ -3730,34 +3730,39 @@ char *sqlCheckIdentifier(char *identifier) /* Check that only valid identifier characters are used */ { static boolean init = FALSE; static char allowed[256]; if (!init) { sqlCheckDisallowAllChars(allowed); sqlCheckAllowAlphaNumChars(allowed); sqlCheckAllowChar('.', allowed); sqlCheckAllowChar('_', allowed); // NOTE it is important for security that no other characters be allowed here init = TRUE; } +/* A good idea but code is currently using empty in table names at least. +See src/hg/lib/gtexTissue.c: +select * from gtexTissue%s order by id +This could be re-worked someday, but not now. refs #22596 if (identifier[0] == 0) // empty string not allowed since this is usually caused by an error. { sqlCheckError("Illegal empty string identifier not allowed."); } +*/ if (!sqlCheckAllowedChars(identifier, allowed)) { sqlCheckError("Illegal character found in identifier %s", identifier); } return identifier; } /* --------------------------- */ int sqlEscapeAllStrings(char *buffer, char *s, int bufSize, char escPunc) /* Escape all strings demarked by escPunc char. * * Returns final size not including terminating 0. * User needs to pre-allocate enough space that mysql_escape will never run out of space.