string.escape()

[cbk1994]

string.escape() places a backslash in front of quotation marks. SQLite doesn't require quotation marks to be escaped at all, so ideally it should be fixed, and another function should be added (if needed) for MySQL support (accounts database?).

[LoneAngelIbesu]

... Wha? That's what escaping is, and the point of escaping is to prevent SQL injections, not because SQLite can't handle quotation marks.

[cbk1994]

Originally Posted by LoneAngelIbesu

... Wha? That's what escaping is, and the point of escaping is to prevent SQL injections, not because SQLite can't handle quotation marks.

I'm tempted to say the same thing to you: wha?

If you feed SQLite as string such as:

PHP Code:

test "foo" bar 


it will enter perfectly fine:

PHP Code:

INSERT INTO table (column) VALUES ('test "foo" bar') 


str.escape() places backslashes in front of quotations. Basically, it does:

PHP Code:

INSERT INTO table (column) VALUES ('test \"foo\" bar') 


It's literally inserted into SQLite as:

PHP Code:

test \"foo\" bar 


Unlike single quotations, quotation marks don't need to be escaped, and escaping them only makes strings enter incorrectly.

I think maybe you thought I was referring to single quotes instead of quotation marks in my post, sorry; could've been more clear about that.

[LoneAngelIbesu]

Originally Posted by cbk1994

Unlike single quotations, quotation marks don't need to be escaped, and escaping them only makes strings enter incorrectly.

Oh, I see what you're saying, now. Yes, that probably does need to be fixed. My second nature is to still be weary about quotations when it comes to user-submitted SQL entries, though. Even if they're double-quotations.

[cbk1994]

bump

[Loriel]

What makes you think escape() is for sqlite?

[cbk1994]

Originally Posted by Loriel

What makes you think escape() is for sqlite?

Stefan has said to use it for SQLite and uses it himself. He has also made changes to it for SQLite.

[Loriel]

Well that is rather ridiculous considering sql has different escaping rules than everything else

my apologies, but, uh, just do not do it anyway.

[Inverness]

Originally Posted by Loriel

Well that is rather ridiculous considering sql has different escaping rules than everything else

my apologies, but, uh, just do not do it anyway.

Yea, that is my issue. I remember suggesting a separate sqlescape() function since the rules are different for that, and Stefan just changed the default escape and messed it all up.

My reaction:

[cbk1994]

This is still a problem after the NPC-server update

[Admins]

Originally Posted by Inverness

Yea, that is my issue. I remember suggesting a separate sqlescape() function since the rules are different for that, and Stefan just changed the default escape and messed it all up.

The escape command has already been existing since 2007 and used for mysql queries since 2007.

[cbk1994]

Originally Posted by Stefan

The escape command has already been existing since 2007 and used for mysql queries since 2007.

" (quotation marks) don't need to be escaped in MySQL either. Can you please fix it?

[WhiteDragon]

Originally Posted by cbk1994

" (quotation marks) don't need to be escaped in MySQL either. Can you please fix it?

Double quotes are used in the SQL syntax as identifers (like backticks: `). MySQL doesn't follow that specification if the ANSI_QUOTES SQL mode isn't enabled. Instead, MySQL uses them as string quotes in that case (like single quotes: ').

So really, the proper way to go about this is always use single quotes and only escape single quotes (go ahead and make your own function). But escaping both leaves no room for injection, only room for extra backslashes, which can be fixed.

[Inverness]

Originally Posted by Stefan

The escape command has already been existing since 2007 and used for mysql queries since 2007.

The whole point of what I said is that normal escape rules aren't like those for SQLite, so there needs to be a separate function.

[LoneAngelIbesu]

Originally Posted by WhiteDragon

... only room for extra backslashes, which can be fixed.

Bumping this, and asking for stripslashes() function.

[benpoke103]

Originally Posted by LoneAngelIbesu

Bumping this, and asking for stripslashes() function.

^ This.

[LoneAngelIbesu]

Modified Dusty's replacetext() function into a simple stripslashes() function. It wakes into account new lines (\n). I don't know if there's more to take into account, since I really only needed to script something so that it doesn't ruin new lines.

PHP Code:

function stripslashes(txt,a,b) { 
  // a=\ b=""
  if (txt.pos(a)<0) return txt; 
  temp.txtpos = txt.positions(a); 
  temp.newtxt = txt.substring(0,txtpos[0]); 
  for (temp.i=0;i<txtpos.size();i++) { 
    if(txt.substring(txtpos[i]+1,1) == "n") {
      newtxt @= "\\n";
      newtxt @= txt.substring(txtpos[i]+a.length()+1,txt.substring(txtpos[i]+a.length()+1).pos(a));
    }
    else {
      newtxt @= b; 
      newtxt @= txt.substring(txtpos[i]+a.length(),txt.substring(txtpos[i]+a.length()).pos(a)); 
    }
  } 
  return newtxt; 
} 


Use: stripslashes(mystring, "\\", "");

[cbk1994]

This is absolutely ridiculous. This should have been fixed six months ago. Why hasn't it been done?

[Crow]

Originally Posted by cbk1994

This is absolutely ridiculous. This should have been fixed six months ago. Why hasn't it been done?

It's all your fault, you failed to bump this topic.

[cbk1994]

Originally Posted by cbk1994

This is absolutely ridiculous. This should have been fixed six months ago. Why hasn't it been done?

See quote. This is rather important.

[cbk1994]

16 months later...

[Admins]

Ok will add a new function escapestring2(string).
If that function is tested and fine then we can also integrate it similar to escapestring(string) which is additionally mapped to string.escape().

[cbk1994]

Originally Posted by Stefan

Ok will add a new function escapestring2(string).
If that function is tested and fine then we can also integrate it similar to escapestring(string) which is additionally mapped to string.escape().

Sounds good, thanks Stefan .

[cbk1994]

Originally Posted by Stefan

Ok will add a new function escapestring2(string).
If that function is tested and fine then we can also integrate it similar to escapestring(string) which is additionally mapped to string.escape().

I've tested escapestring2 and it is working with all ASCII characters above 29. Thanks Stefan .