Schneier on Security

Lawrence D'Oliveiro • October 12, 2007 10:37 PM

For calling MySQL from C++:

void SQLString
(
istream & In,
ostream & Out
)
/* writes a MySQL string literal to Out which evaluates to In. /
{
Out.put(‘”‘);
for (;;)
{
uchar ThisCh;
ThisCh = In.get();
if (In.eof())
break;
switch (ThisCh)
{
case 0:
Out.put(‘\’);
Out.put(‘0’);
break;
case 8:
Out.put(‘\’);
Out.put(‘b’);
break;
case 9:
Out.put(‘\’);
Out.put(‘t’);
break;
case 10:
Out.put(‘\’);
Out.put(‘n’);
break;
case 13:
Out.put(‘\’);
Out.put(‘r’);
break;
case 26:
Out.put(‘\’);
Out.put(‘z’);
break;
case ‘”‘:
case ‘\”:
case ‘\’:
Out.put(‘\’);
Out.put(ThisCh);
break;
default:
Out.put(ThisCh);
break;
} /switch/
} /for/
Out.put(‘”‘);
} /SQLString*/

Oh yes, and

void QuoteSQLWild
(
istream & In,
ostream & Out
)
/* writes In to Out, escaping “%” and “” characters. */
{
for (;;)
{
uchar ThisCh;
ThisCh = In.get();
if (In.eof())
break;
if (ThisCh == ‘\’ or ThisCh == ‘%’ or ThisCh == ‘‘)
{
Out.put(‘\’);
} /if/
Out.put(ThisCh);
} /for/
} /QuoteSQLWild/

for putting user-entered strings into “like” clauses. ALWAYS use these in building your MySQL statements, and you can kiss those SQL injection vulnerabilities goodbye!

As a handy side effect, they also allow you to handle arbitrary binary data in your databases.