escape reserved chars in string.

copy from builder.c


git-svn-id: svn+ssh://svn.gnucash.org/repo/gnucash/trunk@4357 57a11ea4-9604-0410-9ed3-97b8803252fd

src/engine/sql/escape.c

@@ -0,0 +1,131 @@
+/********************************************************************\
+ * escape.c : escape SQL reserved characters                        *
+ * Copyright (C) 2001 Linas Vepstas <linas@linas.org>               *
+ *                                                                  *
+ * This program is free software; you can redistribute it and/or    *
+ * modify it under the terms of the GNU General Public License as   *
+ * published by the Free Software Foundation; either version 2 of   *
+ * the License, or (at your option) any later version.              *
+ *                                                                  *
+ * This program is distributed in the hope that it will be useful,  *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of   *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the    *
+ * GNU General Public License for more details.                     *
+ *                                                                  *
+ * You should have received a copy of the GNU General Public License*
+ * along with this program; if not, contact:                        *
+ *                                                                  *
+ * Free Software Foundation           Voice:  +1-617-542-5942       *
+ * 59 Temple Place - Suite 330        Fax:    +1-617-542-2652       *
+ * Boston, MA  02111-1307,  USA       gnu@gnu.org                   *
+\********************************************************************/
+
+/*
+ * FILE:
+ * esacpe.c
+ *
+ * FUNCTION:
+ * Escapes the ' and \ characters in a string
+ */
+
+#define _GNU_SOURCE
+#include <glib.h>
+#include <string.h>
+
+#include "escape.h"
+
+/* ================================================ */
+
+struct _escape {
+   /* pointer to memory used for escaping arguments */
+   char * escape;
+   size_t esc_buflen;
+};
+
+/* ================================================ */
+/* escape single-quote marks and backslashes so that the 
+ * database SQL parser doesn't puke on the query string 
+ */
+
+const char *
+sqlEscapeString (sqlEscape *b, const char *str)
+{
+   const char *p, *src_head;
+   char *dst_tail;
+   size_t len, slen;
+   
+   /* if nothing to escape, just return */
+   len = strlen (str);
+   slen = strcspn (str, "\\\'");
+   if (len == slen) return str;
+
+   /* count to see how much space we'll need */
+   p = str + slen + 1;
+   while (*p)
+   {
+      len ++;
+      p += 1 + strcspn (p, "\\\'");
+   }
+
+   /* get more space, if needed */
+   if (len >= b->esc_buflen)
+   {
+      b->escape = g_realloc(b->escape, len+100);
+      b->esc_buflen = len+100;
+   }
+
+   /* copy and escape */
+   src_head = (char *) str;
+   dst_tail = b->escape;
+   p = src_head + strcspn (src_head, "\\\'");
+   while (*p)
+   {
+      size_t cp_len = p - src_head;
+
+      strncpy (dst_tail, src_head, cp_len);
+      dst_tail += cp_len;
+      *dst_tail = '\\';
+      dst_tail ++;
+      *dst_tail = *p;
+      dst_tail ++;
+
+      src_head = p+1;
+      p = src_head + strcspn (src_head, "\\\'");
+   }
+   if (p != src_head)
+   {
+      size_t cp_len = p - src_head;
+
+      strncpy (dst_tail, src_head, cp_len);
+      dst_tail += cp_len;
+   }
+   *dst_tail = 0;
+
+   return b->escape;
+}
+
+/* ================================================ */
+
+#define INITIAL_BUFSZ 2000
+
+sqlEscape *
+sqlEscape_new (void)
+{
+   sqlEscape *b = g_new (sqlEscape, 1);
+
+   b->escape = g_malloc (INITIAL_BUFSZ);
+   b->esc_buflen = INITIAL_BUFSZ;
+   return (b);
+}
+
+/* ================================================ */
+
+void
+qlEscape_destroy (sqlEscape *b)
+{
+   if (!b) return;
+   g_free (b->escape);     b->escape = NULL;
+   g_free (b);
+}
+
+/* ================ END OF FILE ==================== */

src/engine/sql/escape.h

@@ -0,0 +1,45 @@
+/********************************************************************\
+ * escape.h : Escape SQL reserved characters in strings             *
+ * Copyright (C) 2001 Linas Vepstas <linas@linas.org>               *
+ *                                                                  *
+ * This program is free software; you can redistribute it and/or    *
+ * modify it under the terms of the GNU General Public License as   *
+ * published by the Free Software Foundation; either version 2 of   *
+ * the License, or (at your option) any later version.              *
+ *                                                                  *
+ * This program is distributed in the hope that it will be useful,  *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of   *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the    *
+ * GNU General Public License for more details.                     *
+ *                                                                  *
+ * You should have received a copy of the GNU General Public License*
+ * along with this program; if not, contact:                        *
+ *                                                                  *
+ * Free Software Foundation           Voice:  +1-617-542-5942       *
+ * 59 Temple Place - Suite 330        Fax:    +1-617-542-2652       *
+ * Boston, MA  02111-1307,  USA       gnu@gnu.org                   *
+\********************************************************************/
+
+/*
+ * FILE:
+ * escape.h
+ *
+ * FUNCTION:
+ * Escape SQL reserved cahracters \ and ' from strings
+ *
+ * HISTORY:
+ * Linas Vepstas January 2001
+ */
+
+#ifndef __SQL_ESCAPE_H__
+#define __SQL_ESCAPE_H__
+
+typedef struct _escape sqlEscape;
+
+sqlEscape * sqlEscape_new(void);
+void sqlEscape_destroy (sqlEscape *);
+
+const char * sqlEscapeString (sqlEscape *, const char *orig_string);
+
+#endif /* __SQL_ESCAPE_H__ */
+