SQL Escaping in MySQL
Posted: Tue Apr 17, 2007 2:16 pm
Add the following lines to your mysql.lsp library, depending on the version of mysql client lib you have:
MySQL4
MySQL5
These will escape newlines, single and double ticks, etc, to prevent sql injection.
Code: Select all
(import libmysqlclient "mysql_escape_string") ; MySQL4
(import libmysqlclient "mysql_real_escape_string") ; MySQL5Code: Select all
(define (escape value , safe-value)
"Escapes input value using mysql_escape_string."
(set 'safe-value (dup " " (+ 1 (length value))))
(MySQL:mysql_escape_string safe-value value (length value))
safe-value)Code: Select all
(define (escape value , safe-value)
"Escapes input value using mysql_real_escape_string."
(set 'safe-value (dup " " (+ 1 (length value))))
(MySQL:mysql_real_escape_string MySQL:MYSQL safe-value value (length value))
safe-value)