Use PQescapeString() instead of str_escape()

--HG--
branch : HEAD

diff --git a/src/auth/db-pgsql.c b/src/auth/db-pgsql.c
index 35dc6c8378d2c3e5eead48db17b0fcde503bdaa4..edd166b2b2b1d2783860b3556acfba870522ab0f 100644 (file)
--- a/src/auth/db-pgsql.c
+++ b/src/auth/db-pgsql.c
@@ -35,6 +35,17 @@ static struct pgsql_connection *pgsql_connections = NULL;
 static int pgsql_conn_open(struct pgsql_connection *conn);
 static void pgsql_conn_close(struct pgsql_connection *conn);
 
+const char *db_pgsql_escape(const char *str)
+{
+       char *esc_str;
+       size_t len = strlen(str);
+
+       /* @UNSAFE */
+       esc_str = t_malloc(len*2+1);
+       PQescapeString(esc_str, str, len);
+       return esc_str;
+}
+
 void db_pgsql_query(struct pgsql_connection *conn, const char *query,
                    struct pgsql_request *request)
 {

diff --git a/src/auth/db-pgsql.h b/src/auth/db-pgsql.h
index b7faf5930ed50940e37cca8f3dc77db10a4a0e7b..cc9286384c9399b30a82e62207fea8384e0c99c1 100644 (file)
--- a/src/auth/db-pgsql.h
+++ b/src/auth/db-pgsql.h
@@ -37,6 +37,8 @@ struct pgsql_request {
        void *context;
 };
 
+const char *db_pgsql_escape(const char *str);
+
 void db_pgsql_query(struct pgsql_connection *conn, const char *query,
                    struct pgsql_request *request);
 

diff --git a/src/auth/passdb-pgsql.c b/src/auth/passdb-pgsql.c
index 380dddef1acd79815ddd5d7f3333445bbd767af8..5073b539b7a32e296ca9a53e05077dcf537e8bc8 100644 (file)
--- a/src/auth/passdb-pgsql.c
+++ b/src/auth/passdb-pgsql.c
@@ -105,7 +105,7 @@ static void pgsql_lookup_pass(struct auth_request *auth_request,
 
        str = t_str_new(512);
        var_expand(str, conn->set.password_query,
-                  str_escape(auth_request->user), NULL);
+                  db_pgsql_escape(auth_request->user), NULL);
        query = str_c(str);
 
        pgsql_request->callback = pgsql_handle_request;

diff --git a/src/auth/userdb-pgsql.c b/src/auth/userdb-pgsql.c
index be80cf8df04857ddf399ccccbea9a81e43455131..2134335799b74e70216d567917ff29804f56ae67 100644 (file)
--- a/src/auth/userdb-pgsql.c
+++ b/src/auth/userdb-pgsql.c
@@ -93,7 +93,7 @@ static void userdb_pgsql_lookup(const char *user, userdb_callback_t *callback,
        string_t *str;
 
        str = t_str_new(512);
-       var_expand(str, conn->set.user_query, str_escape(user), NULL);
+       var_expand(str, conn->set.user_query, db_pgsql_escape(user), NULL);
        query = str_c(str);
 
        request = i_malloc(sizeof(struct userdb_pgsql_request) + strlen(user));