diff --git a/src/common/libs/sqlEscaper.js b/src/common/libs/sqlEscaper.js new file mode 100644 index 00000000..097f1c34 --- /dev/null +++ b/src/common/libs/sqlEscaper.js @@ -0,0 +1,19 @@ +/* eslint-disable no-useless-escape */ +// eslint-disable-next-line no-control-regex +const regex = new RegExp(/[\0\x08\x09\x1a\n\r"'\\\%]/g); + +/** + * Escapes a string + * + * @param {String} string + * @returns {String} + */ +function sqlEscaper (string) { + return string.replace(regex, (char) => { + var m = ['\\0', '\\x08', '\\x09', '\\x1a', '\\n', '\\r', '\'', '"', '\\', '\\\\', '%']; + var r = ['\\\\0', '\\\\b', '\\\\t', '\\\\z', '\\\\n', '\\\\r', '\'\'', '""', '\\\\', '\\\\\\\\', '\\%']; + return r[m.indexOf(char)]; + }); +} + +export { sqlEscaper }; diff --git a/src/main/index.js b/src/main/index.js index 78018c83..53fcc98b 100644 --- a/src/main/index.js +++ b/src/main/index.js @@ -64,12 +64,12 @@ async function createMainWindow () { }); }); - // Initialize ipcHandlers - ipcHandlers(); - return window; }; +// Initialize ipcHandlers +ipcHandlers(); + // quit application when all windows are closed app.on('window-all-closed', () => { // on macOS it is common for applications to stay open until the user explicitly quits diff --git a/src/main/models/Tables.js b/src/main/models/Tables.js index c9d12477..5a872cd7 100644 --- a/src/main/models/Tables.js +++ b/src/main/models/Tables.js @@ -1,4 +1,5 @@ 'use strict'; +import { sqlEscaper } from 'common/libs/sqlEscaper'; export default class { static async getTableData (connection, schema, table) { return connection @@ -9,9 +10,29 @@ export default class { .run(); } - static async updateTableCell (connection, params) { // TODO: Handle different field types + static async updateTableCell (connection, params) { + let escapedParam; + switch (params.type) { + case 'int': + case 'tinyint': + case 'smallint': + case 'mediumint': + case 'bigint': + escapedParam = params.content; + break; + case 'char': + case 'varchar': + case 'text': + case 'mediumtext': + case 'longtext': + escapedParam = `"${sqlEscaper(params.content)}"`; + break; + default: + escapedParam = `"${sqlEscaper(params.content)}"`; + break; + } return connection - .update({ [params.field]: `= "${params.content}"` }) + .update({ [params.field]: `= ${escapedParam}` }) .schema(params.schema) .from(params.table) .where({ [params.primary]: `= ${params.id}` }) diff --git a/src/renderer/components/BaseConfirmModal.vue b/src/renderer/components/BaseConfirmModal.vue index 20746177..926708c9 100644 --- a/src/renderer/components/BaseConfirmModal.vue +++ b/src/renderer/components/BaseConfirmModal.vue @@ -1,5 +1,5 @@