SQL injection fix.

Google sanitizing sql input. almost every single article explains why you should never attempt to roll your own function to do this.
2026-08-28 06:27:26 +01:00 · 2014-08-11 20:56:10 -04:00
parent e08fb5d1d0
commit c0b8e02eee
1 changed files with 1 additions and 3 deletions
@@ -15,9 +15,7 @@

 // Run all strings to be used in an SQL query through this proc first to properly escape out injection attempts.
 /proc/sanitizeSQL(var/t as text)
-	var/sanitized_text = replacetext(t, "'", "\\'")
-	sanitized_text = replacetext(sanitized_text, "\"", "\\\"")
-	return sanitized_text
+	return dbcon.Quote(t);

 /*
 * Text sanitization