Skip to content

Escape bind_vars values to prevent SQL injection #55

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sknair wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Escape bind_vars values to prevent SQL injection #55

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion tePLSQL.pkb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -604,8 +604,12 @@ AS

procedure replace_vars( i_key in varchar2, i_value in varchar2 )
as
c_quoted_end constant varchar2(10) := ']''';
c_quoted_end_escaped constant varchar2(10) := ']"';
c_quoted_start constant varchar2(10) := 'q''[';
c_quoted_start_escaped constant varchar2(10) := 'q"[';
begin
p_template := REPLACE (p_template, '${' || i_key || '}', TO_CLOB ( i_value ));
p_template := REPLACE (p_template, '${' || i_key || '}', replace(replace(TO_CLOB ( i_value ), c_quoted_end, c_quoted_end_escaped), c_quoted_start, c_quoted_start_escaped));
end;
BEGIN
if g_render_mode = g_render_mode_fetch_only
Expand Down