• ddos (3/3) Jul 21 2015 How do i sanitize a string for database query?
• Adam D. Ruppe (4/6) Jul 21 2015 You generally shouldn't even try, instead use the database
• Gary Willoughby (3/6) Jul 21 2015 Use prepared statements instead.
• ddos (9/16) Jul 21 2015 thx for reminding me of prepared statements
• Alex Parrill (9/27) Jul 21 2015 No it won't. The actual contents of your query parameters are
• ddos (1/1) Jul 21 2015 thx
• Gary Willoughby (3/21) Jul 21 2015 Prepared statements handle this just fine. In fact that's why

"ddos" <oggs gmx.at> writes:

How do i sanitize a string for database query?
Is there some builtin function?

thx :)

"Adam D. Ruppe" <destructionator gmail.com> writes:

On Tuesday, 21 July 2015 at 17:23:30 UTC, ddos wrote:
 How do i sanitize a string for database query?

You generally shouldn't even try, instead use the database 
functions that bind parameters to the procedure.

 Is there some builtin function?


It is different for each database target.

"Gary Willoughby" <dev nomad.so> writes:

On Tuesday, 21 July 2015 at 17:23:30 UTC, ddos wrote:
 How do i sanitize a string for database query?
 Is there some builtin function?

 thx :)

Use prepared statements instead.

https://en.wikipedia.org/wiki/Prepared_statement

"ddos" <oggs gmx.at> writes:

On Tuesday, 21 July 2015 at 17:58:55 UTC, Gary Willoughby wrote:
 On Tuesday, 21 July 2015 at 17:23:30 UTC, ddos wrote:
 How do i sanitize a string for database query?
 Is there some builtin function?

 thx :)

 Use prepared statements instead.

 https://en.wikipedia.org/wiki/Prepared_statement

thx for reminding me of prepared statements
this is ok for preventing an sql injection i guess, but still my 
insert would fail.
maybe i should have specified what i want to achieve:

i have a plugin for a call of duty gameserver, this plugin is 
able to ban players from the server by inserting name/ip/etc.. 
into a sql database. it is priority that the insert never fails. 
e.g. name could contain a ' which lets my insert fail.

"Alex Parrill" <initrd.gz gmail.com> writes:

On Tuesday, 21 July 2015 at 18:55:53 UTC, ddos wrote:
 On Tuesday, 21 July 2015 at 17:58:55 UTC, Gary Willoughby wrote:
 On Tuesday, 21 July 2015 at 17:23:30 UTC, ddos wrote:
 How do i sanitize a string for database query?
 Is there some builtin function?

 thx :)

 Use prepared statements instead.

 https://en.wikipedia.org/wiki/Prepared_statement

 thx for reminding me of prepared statements
 this is ok for preventing an sql injection i guess, but still 
 my insert would fail.
 maybe i should have specified what i want to achieve:

 i have a plugin for a call of duty gameserver, this plugin is 
 able to ban players from the server by inserting name/ip/etc.. 
 into a sql database. it is priority that the insert never 
 fails. e.g. name could contain a ' which lets my insert fail.

No it won't. The actual contents of your query parameters are 
irrelevant and are stored as-is; that's the entire point of using 
query parameters.

Example using d2sqlite3:

	auto db = Database(":memory:");
	auto stmt = db.prepare("INSERT INTO banned VALUES (?);")
	stmt.bindAll("O'chucks");
	stmt.execute(); // works fine

"ddos" <oggs gmx.at> writes:

thx

"Gary Willoughby" <dev nomad.so> writes:

On Tuesday, 21 July 2015 at 18:55:53 UTC, ddos wrote:
 On Tuesday, 21 July 2015 at 17:58:55 UTC, Gary Willoughby wrote:
 On Tuesday, 21 July 2015 at 17:23:30 UTC, ddos wrote:
 How do i sanitize a string for database query?
 Is there some builtin function?

 thx :)

 Use prepared statements instead.

 https://en.wikipedia.org/wiki/Prepared_statement

 thx for reminding me of prepared statements
 this is ok for preventing an sql injection i guess, but still 
 my insert would fail.
 maybe i should have specified what i want to achieve:

 i have a plugin for a call of duty gameserver, this plugin is 
 able to ban players from the server by inserting name/ip/etc.. 
 into a sql database. it is priority that the insert never 
 fails. e.g. name could contain a ' which lets my insert fail.

Prepared statements handle this just fine. In fact that's why 
they exist, to handle this case.