Problem - Kevin Tafuro

Finally, if you are using the LIKE keyword in a WHERE clause, you may wish to prevent
input from containing wildcard characters. In fact, it is a good idea to prevent
wildcard characters in most circumstances. Wildcard characters include the
percent symbol, underscore, and square brackets.
You can use the function spc_escape_sql( ), shown at the end of this section, to
escape all of the characters that we’ve mentioned. As a convenience (and partly due
to necessity), the function will also surround the escaped string with the quote character
of your choice. The return from the function will be the quoted and escaped
version of the input string. If an error occurs (e.g., out of memory, or an invalid quoting
character chosen), the return will be NULL.
spc_escape_sql( ) requires three arguments:
input
The string that is to be escaped.
quote
The quote character to use. It must be either a single or double quote. Any other
character will cause spc_escape_sql( ) to return failure.
wildcards
If this argument is specified as 0, wildcard characters recognized by the LIKE
operator in a WHERE clause will not be escaped; otherwise, they will be. You
should only escape wildcards when you are going to be using the escaped string
as the right-hand side for the LIKE operator.
#include
#include
char *spc_escape_sql(const char *input, char quote, int wildcards) {
char *out, *ptr;
const char *c;
/* If every character in the input needs to be escaped, the resulting string
* would at most double in size. Also, include room for the surrounding
* quotes.
*/
if (quote != '\'' && quote != '\"') return 0;
if (!(out = ptr = (char *)malloc(strlen(input) * 2 + 2 + 1))) return 0;
*ptr++ = quote;
for (c = input; *c; c++) {
switch (*c) {
case '\'': case '\"':
if (quote == *c) *ptr++ = *c;
*ptr++ = *c;
break;
case '%': case '_': case '[': case ']':
if (wildcards) *ptr++ = '\\';
*ptr++ = *c;
break;
case '\\': *ptr++ = '\\'; *ptr++ = '\\'; break;
Preventing SQL Injection Attacks | 109
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.