Skip to content

LibSqlUtils.escape() no-quote guard uses == 1 instead of == -1, leaving some values un-escaped #68

Closed

Description

@chiliec

LibSqlUtils.escape() doubles single quotes for values embedded in the concatenated metadata SQL (pragma index_list / index_info / foreign_key_list and related DatabaseMetaData queries).

The early-return guard reads value.indexOf('\'') == 1 instead of == -1. The intent is "return the value unchanged when it contains no single quote", i.e. when indexOf returns -1. With == 1, any value whose first single quote is at index 1 (e.g. x') is returned un-escaped, so the quote closes the surrounding string literal — a correctness/SQL-injection hazard in metadata queries built from such values.

Expected

Values are returned unchanged only when they contain no single quote; otherwise every single quote is doubled.

Fix

Change the guard to == -1.

PR: #64

Activity

  1. added a commit that references this issue on Nov 3, 2026
  2. changed the issue type fromtoon Nov 3, 2026
  3. added a commit that references this issue on Nov 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

Type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions