debian/midori
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Use sqlite3_mprintf to quote when inserting bookmark items

Browse source
This commit is contained in:
Christian Dywan 2010-07-11 23:49:13 +02:00
parent df1f754a56
commit 5a082100c8
1 changed files with 3 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
panels/midori-bookmarks.c
View file

@ -232,12 +232,9 @@ midori_bookmarks_insert_item_db (sqlite3* db,
else else
parent = g_strdup (""); parent = g_strdup ("");
/* Workaround a sqlite3_mprintf error with sqlcmd = sqlite3_mprintf (
handling of katze_item_get_meta_integer(). */
/* FIXME: Need proper single quote escaping. */
sqlcmd = g_strdup_printf (
"INSERT into bookmarks (uri, title, folder, toolbar, app) values" "INSERT into bookmarks (uri, title, folder, toolbar, app) values"
" ('%s', '%s', '%s', %d, %d)", " ('%q', '%q', '%q', %d, %d)",
uri, uri,
katze_item_get_name (item), katze_item_get_name (item),
parent, parent,
@ -252,7 +249,7 @@ midori_bookmarks_insert_item_db (sqlite3* db,
g_free (uri); g_free (uri);
g_free (parent); g_free (parent);
g_free (sqlcmd); sqlite3_free (sqlcmd);
} }
void void