Skip to content

Commit 916a1f2

Browse files
committed
escapeString -> escapeBackslash
1 parent 8826242 commit 916a1f2

File tree

4 files changed

+9
-12
lines changed

4 files changed

+9
-12
lines changed

connection.go

+4-7
Original file line numberDiff line numberDiff line change
@@ -167,16 +167,13 @@ func (mc *mysqlConn) Prepare(query string) (driver.Stmt, error) {
167167

168168
// https://github.com/mysql/mysql-server/blob/mysql-5.7.5/libmysql/libmysql.c#L1150-L1156
169169
func (mc *mysqlConn) escapeBytes(buf, v []byte) []byte {
170-
var escape func([]byte, []byte) []byte
170+
buf = append(buf, '\'')
171171
if mc.status&statusNoBackslashEscapes == 0 {
172-
escape = escapeString
172+
buf = escapeBackslash(buf, v)
173173
} else {
174-
escape = escapeQuotes
174+
buf = escapeQuotes(buf, v)
175175
}
176-
buf = append(buf, '\'')
177-
buf = escape(buf, v)
178-
buf = append(buf, '\'')
179-
return buf
176+
return append(buf, '\'')
180177
}
181178

182179
// estimateParamLength calculates upper bound of string length from types.

driver_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -1556,7 +1556,7 @@ func TestSqlInjection(t *testing.T) {
15561556

15571557
var v int
15581558
// NULL can't be equal to anything, the idea here is to inject query so it returns row
1559-
// This test verifies that EscapeQuotes and EscapeStrings are working properly
1559+
// This test verifies that escapeQuotes and escapeBackslash are working properly
15601560
err := dbt.db.QueryRow("SELECT v FROM test WHERE NULL = ?", arg).Scan(&v)
15611561
if err == sql.ErrNoRows {
15621562
return // success, sql injection failed
@@ -1583,7 +1583,7 @@ func TestInsertRetrieveEscapedData(t *testing.T) {
15831583
testData := func(dbt *DBTest) {
15841584
dbt.mustExec("CREATE TABLE test (v VARCHAR(255))")
15851585

1586-
// All sequences that are escaped by EscapeQuotes and EscapeString
1586+
// All sequences that are escaped by escapeQuotes and escapeBackslash
15871587
v := "foo \x00\n\r\x1a\"'\\"
15881588
dbt.mustExec("INSERT INTO test VALUES (?)", v)
15891589

utils.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -812,7 +812,7 @@ func appendLengthEncodedInteger(b []byte, n uint64) []byte {
812812
// characters, and turning others into specific escape sequences, such as
813813
// turning newlines into \n and null bytes into \0.
814814
// https://github.com/mysql/mysql-server/blob/mysql-5.7.5/mysys/charset.c#L823-L932
815-
func escapeString(buf, v []byte) []byte {
815+
func escapeBackslash(buf, v []byte) []byte {
816816
pos := len(buf)
817817
end := pos + len(v)*2
818818
if cap(buf) < end {

utils_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -253,9 +253,9 @@ func TestFormatBinaryDateTime(t *testing.T) {
253253
expect("1978-12-30 15:46:23.987654", 11, 26)
254254
}
255255

256-
func TestEscapeString(t *testing.T) {
256+
func TestEscapeBackslash(t *testing.T) {
257257
expect := func(expected, value string) {
258-
actual := string(escapeString([]byte{}, []byte(value)))
258+
actual := string(escapeBackslash([]byte{}, []byte(value)))
259259
if actual != expected {
260260
t.Errorf(
261261
"expected %s, got %s",

0 commit comments

Comments
 (0)