Graal Forums - string.escape()

Graal Forums (https://forums.graalonline.com/forums/index.php)

- Future Improvements (https://forums.graalonline.com/forums/forumdisplay.php?f=10)

- - string.escape() (https://forums.graalonline.com/forums/showthread.php?t=134257708)

cbk1994

01-19-2010 09:25 AM

string.escape()

string.escape() places a backslash in front of quotation marks. SQLite doesn't require quotation marks to be escaped at all, so ideally it should be fixed, and another function should be added (if needed) for MySQL support (accounts database?).

LoneAngelIbesu

01-20-2010 02:13 AM

... Wha? That's what escaping is, and the point of escaping is to prevent SQL injections, not because SQLite can't handle quotation marks. :\

cbk1994

01-20-2010 02:23 AM

Quote:

Originally Posted by LoneAngelIbesu (Post 1551370)

... Wha? That's what escaping is, and the point of escaping is to prevent SQL injections, not because SQLite can't handle quotation marks. :\

I'm tempted to say the same thing to you: wha?

If you feed SQLite as string such as:

PHP Code:


		
			
test "foo" bar

it will enter perfectly fine:

PHP Code:


		
			
INSERT INTO table (column) VALUES ('test "foo" bar')

str.escape() places backslashes in front of quotations. Basically, it does:

PHP Code:


		
			
INSERT INTO table (column) VALUES ('test \"foo\" bar')

It's literally inserted into SQLite as:

PHP Code:


		
			
test \"foo\" bar

Unlike single quotations, quotation marks don't need to be escaped, and escaping them only makes strings enter incorrectly.

I think maybe you thought I was referring to single quotes instead of quotation marks in my post, sorry; could've been more clear about that.

LoneAngelIbesu

01-20-2010 04:51 AM

Quote:

Originally Posted by cbk1994 (Post 1551372)

Unlike single quotations, quotation marks don't need to be escaped, and escaping them only makes strings enter incorrectly.

Oh, I see what you're saying, now. Yes, that probably does need to be fixed. My second nature is to still be weary about quotations when it comes to user-submitted SQL entries, though. Even if they're double-quotations.

cbk1994

02-21-2010 03:41 PM

bump

Loriel

02-21-2010 06:29 PM

What makes you think escape() is for sqlite?

cbk1994

02-21-2010 06:47 PM

Quote:

Originally Posted by Loriel (Post 1557657)

What makes you think escape() is for sqlite?

Stefan has said to use it for SQLite and uses it himself. He has also made changes to it for SQLite.

Loriel

02-21-2010 09:28 PM

Well that is rather ridiculous considering sql has different escaping rules than everything else

my apologies, but, uh, just do not do it anyway.

Inverness

02-21-2010 10:56 PM

Quote:

Originally Posted by Loriel (Post 1557687)

Well that is rather ridiculous considering sql has different escaping rules than everything else

my apologies, but, uh, just do not do it anyway.

Yea, that is my issue. I remember suggesting a separate sqlescape() function since the rules are different for that, and Stefan just changed the default escape and messed it all up.

My reaction:
http://inverness.dreamhosters.com/images/facepalm.jpg

cbk1994

03-03-2010 07:29 AM

This is still a problem after the NPC-server update :(

Admins

03-03-2010 05:06 PM

Quote:

Originally Posted by Inverness (Post 1557705)

Yea, that is my issue. I remember suggesting a separate sqlescape() function since the rules are different for that, and Stefan just changed the default escape and messed it all up.

The escape command has already been existing since 2007 and used for mysql queries since 2007.

cbk1994

03-03-2010 08:56 PM

Quote:

Originally Posted by Stefan (Post 1560393)

The escape command has already been existing since 2007 and used for mysql queries since 2007.

" (quotation marks) don't need to be escaped in MySQL either. Can you please fix it?

WhiteDragon

03-03-2010 11:30 PM

Quote:

Originally Posted by cbk1994 (Post 1560415)

" (quotation marks) don't need to be escaped in MySQL either. Can you please fix it?

Double quotes are used in the SQL syntax as identifers (like backticks: `). MySQL doesn't follow that specification if the ANSI_QUOTES SQL mode isn't enabled. Instead, MySQL uses them as string quotes in that case (like single quotes: ').

So really, the proper way to go about this is always use single quotes and only escape single quotes (go ahead and make your own function). But escaping both leaves no room for injection, only room for extra backslashes, which can be fixed.

Inverness

03-04-2010 06:03 AM

Quote:

Originally Posted by Stefan (Post 1560393)

The escape command has already been existing since 2007 and used for mysql queries since 2007.

The whole point of what I said is that normal escape rules aren't like those for SQLite, so there needs to be a separate function.

LoneAngelIbesu

04-02-2010 03:17 AM

Quote:

Originally Posted by WhiteDragon (Post 1560456)

... only room for extra backslashes, which can be fixed.

Bumping this, and asking for stripslashes() function. :cool:

benpoke103

04-02-2010 04:19 AM

Quote:

Originally Posted by LoneAngelIbesu (Post 1566584)

Bumping this, and asking for stripslashes() function. :cool:

^ This.

LoneAngelIbesu

04-05-2010 06:13 PM

Modified Dusty's replacetext() function into a simple stripslashes() function. It wakes into account new lines (\n). I don't know if there's more to take into account, since I really only needed to script something so that it doesn't ruin new lines.

PHP Code:


		
			
function stripslashes(txt,a,b) { 

  // a=\ b=""

  if (txt.pos(a)<0) return txt; 

  temp.txtpos = txt.positions(a); 

  temp.newtxt = txt.substring(0,txtpos[0]); 

  for (temp.i=0;i<txtpos.size();i++) { 

    if(txt.substring(txtpos[i]+1,1) == "n") {

      newtxt @= "\\n";

      newtxt @= txt.substring(txtpos[i]+a.length()+1,txt.substring(txtpos[i]+a.length()+1).pos(a));

    }

    else {

      newtxt @= b; 

      newtxt @= txt.substring(txtpos[i]+a.length(),txt.substring(txtpos[i]+a.length()).pos(a)); 

    }

  } 

  return newtxt; 

}

Use: stripslashes(mystring, "\\", "");

cbk1994

06-27-2010 03:43 PM

This is absolutely ridiculous. This should have been fixed six months ago. Why hasn't it been done?

Crow	06-27-2010 05:53 PM

Quote:

Originally Posted by cbk1994 (Post 1584359)

This is absolutely ridiculous. This should have been fixed six months ago. Why hasn't it been done?

It's all your fault, you failed to bump this topic.

cbk1994

08-22-2010 03:30 AM

Quote:

Originally Posted by cbk1994 (Post 1584359)

This is absolutely ridiculous. This should have been fixed six months ago. Why hasn't it been done?

See quote. This is rather important.

cbk1994

06-06-2011 06:39 AM

16 months later...

Admins

06-12-2011 08:16 PM

Ok will add a new function escapestring2(string).
If that function is tested and fine then we can also integrate it similar to escapestring(string) which is additionally mapped to string.escape().

cbk1994

06-14-2011 02:39 AM

Quote:

Originally Posted by Stefan (Post 1654501)

Ok will add a new function escapestring2(string).
If that function is tested and fine then we can also integrate it similar to escapestring(string) which is additionally mapped to string.escape().

Sounds good, thanks Stefan :).

cbk1994

07-23-2011 02:27 AM

Quote:

Originally Posted by Stefan (Post 1654501)

Ok will add a new function escapestring2(string).
If that function is tested and fine then we can also integrate it similar to escapestring(string) which is additionally mapped to string.escape().

I've tested escapestring2 and it is working with all ASCII characters above 29. Thanks Stefan :).

All times are GMT +2. The time now is 02:16 AM.