WebSVN – RepoView – Diff – /trunk/CGI/db/sqlite.c

-/* $Id: sqlite.c 31 2024-08-21 19:30:16Z nishi $ */
+/* $Id: sqlite.c 35 2024-08-22 02:53:30Z nishi $ */
 #include "rv_db.h"
 #include "../../config.h"
+}
 char* rv_who_has_token(const char* token) {
 	char* err;
 	count = 0;
+	char* esc = escape_sql(token);
-	char* query = rv_strcat3("select * from tokens where token = '", token, "'");
+	char* query = rv_strcat3("select * from tokens where token = '", esc, "'");
+	free(esc);
 	int ret;
 	has_username = NULL;
 	ret = sqlite3_exec(sql, query, sqlget, (void*)token, &err);
 	free(query);
 	if(ret != SQLITE_OK) {
 	return has_username;
+}
 bool rv_has_token(const char* token) {
 	char* err;
+	char* esc = escape_sql(token);
-	char* query = rv_strcat3("select * from tokens where token = '", token, "'");
+	char* query = rv_strcat3("select * from tokens where token = '", esc, "'");
+	free(esc);
 	int ret;
 	count = 0;
 	ret = sqlite3_exec(sql, query, sqlcount, NULL, &err);
 	free(query);
 	if(ret != SQLITE_OK) {
 	return count > 0;
+}
 void rv_remove_token(const char* token) {
 	char* err;
+	char* esc = escape_sql(token);
-	char* query = rv_strcat3("delete from tokens where token = '", token, "'");
+	char* query = rv_strcat3("delete from tokens where token = '", esc, "'");
+	free(esc);
 	int ret;
 	ret = sqlite3_exec(sql, query, sqlcount, NULL, &err);
 	free(query);
 	if(ret != SQLITE_OK) {
 		sqlite3_free(err);

Subversion Repositories RepoView