Changeset dcefa71

Timestamp:

06/23/11 17:47:43 (10 years ago)

Author:

Philipp Spitzer <philipp@…>

Branches:

master, qt5

Children:

fea60c8

Parents:

68b2df2

Message:

Prevented SQL injections in function addPersonToDB.

File:

• src/sql/sqlengine.cpp (modified) (1 diff)

src/sql/sqlengine.cpp

@@ -217 +217 @@
     if (db.isValid() && db.isOpen())
     {
-        // TODO: SQL Injection!!!
-        QString values = QString("'%1', '%2', '%3'").arg(aPerson["conference_id"],aPerson["id"],aPerson["name"]);
-        QString query = QString("INSERT INTO PERSON (xid_conference,id,name) VALUES (%1)").arg(values);
-        QSqlQuery result (query, db);
-        //LOG_AUTOTEST(query);
-
-        // TODO: SQL Injection!!!
-        values = QString("'%1', '%2', '%3'").arg(aPerson["conference_id"],aPerson["event_id"],aPerson["id"]);
-        query = QString("INSERT INTO EVENT_PERSON (xid_conference,xid_event,xid_person) VALUES (%1)").arg(values);
-        QSqlQuery resultEventPerson (query, db);
-        //LOG_AUTOTEST(query);
+        QSqlQuery query(db);
+        query.prepare("INSERT INTO PERSON (xid_conference,id,name) VALUES (:xid_conference, :id, :name)");
+        query.bindValue(":xid_conference", aPerson["conference_id"]);
+        query.bindValue(":id", aPerson["id"]);
+        query.bindValue(":name", aPerson["name"]);
+        query.exec(); // some queries fail due to the unique key constraint
+        // if (!query.exec()) qDebug() << "SQL query 'insert into person' failed: " << query.lastError();
+
+        query = QSqlQuery(db);
+        query.prepare("INSERT INTO EVENT_PERSON (xid_conference,xid_event,xid_person) VALUES (:xid_conference, :xid_event, :xid_person)");
+        query.bindValue(":xid_conference", aPerson["conference_id"]);
+        query.bindValue(":xid_event", aPerson["event_id"]);
+        query.bindValue(":xid_person", aPerson["id"]);
+        query.exec(); // some queries fail due to the unique key constraint
+        // if (!query.exec()) qDebug() << "SQL query 'insert into event_person' failed: " << query.lastError();
     }
 }