Escaping single quotes about squel HOT 9 CLOSED

First off - thanks for this library @hiddentao.

The point is that the auto-quoting is broken. Simply surrounding a string with single quotes is incorrect and a textbook injection example. I'd argue it's worse than no quoting at all as users may mistakenly assume that proper quoting is implemented.

from squel.

Squel auto-quotes string values. You can tell it to use a different quote character, or you can tell it to not auto-quote.

from squel.

#35

from squel.

@yang I don't know if this helps but #34 has been merged in now, which means that parameterized queries are much easier to do (ideally you should be running a parameterized query through your db engine's query escaping routine so ensure that the query is safe).

As for preventing query injection, #8 is the discussion around that.

from squel.

Hi there, this still seems to be broken at 3.1.1 on node 0.10.26.

squel.insert().into('test').set('q', '{"key":"aint"}').toString()
'INSERT INTO test (q) VALUES (\'{"key":"aint"}\')'

squel.insert().into('test').set('q', '{"key":"ain\'t"}').toString()
'INSERT INTO test (q) VALUES (\'{"key":"ain\'t"}\')'

from squel.

@mayanklahiri What is your expected output?

from squel.

Sorry, it's not immediately obvious because the node shell does some weird escaping if you don't use console.log(). Here's a more clear example, with expected output:

var q = squel.insert().into('test');

console.log(q.set("col", "something").toString())
INSERT INTO test (col) VALUES ('something')

console.log(q.set("col", "some'thing").toString())
INSERT INTO test (col) VALUES ('some'thing')

Clearly the second query has a syntax error (and injection). The expected output (for Postgres) should be (the change is to have two single quotes side by side):

INSERT INTO test (col) VALUES ('some''thing')

I do not know how to quote strings correctly for other databases, but I would imagine it's something like \'

from squel.

Ok, a change was merged into the postgres flavour (#35) which fixed this for that. I might merge that into the core Squel code. That would sort this problem out once and for all.

from squel.

The replaceSingleQuotes option is now available in Squel core, see http://hiddentao.github.io/squel/api.html#cls_defaultquerybuilderoptions

from squel.