Merge pull request #554 from tskong/sqlinjection-quotes

ahmad-moussawi · web-flow · commit a1f8e3f69d2c · 2022-02-13T23:17:58.000+02:00
Escape single quotes for sql injection
diff --git a/QueryBuilder/SqlResult.cs b/QueryBuilder/SqlResult.cs
@@ -81,7 +81,7 @@ private string ChangeToSqlValue(object value)
             }
 
             // fallback to string
-            return "'" + value.ToString() + "'";
+            return "'" + value.ToString().Replace("'","''") + "'";
         }
     }
 }

Original file line number	Diff line number	Diff line change
`@@ -81,7 +81,7 @@ private string ChangeToSqlValue(object value)`
`81`	`81`	`}`
`82`	`82`
`83`	`83`	`// fallback to string`
`84`		`- return "'" + value.ToString() + "'";`
	`84`	`+ return "'" + value.ToString().Replace("'","''") + "'";`
`85`	`85`	`}`
`86`	`86`	`}`
`87`	`87`	`}`