Shibboleth Developers

["Scott Cantor" <>]

> What I expect from makeSafeSQL() is to escape quotes, so maybe line 241
> of odbc-store.cpp should be:
> 
>            if (*src=='\'') *s++ = '\\';
> 
> instead of:
> 
>            if (*src=='\'') *s++ = '\'';

The normal way to escape quotes is with a doubling of the quote, not with a
backslash. I don't believe that every database supports backslash escapes.
Best I can do is make it a parameter.
 
> The log refers to unescaped string, so the double quote is not present.

Right.

-- Scott