SQL escaping

[Phil Mayers]

On 21/09/12 15:52, Arran Cudbard-Bell wrote:

> However, the SQL module has been around for nearly a decade now, so
> it'd be good to provide backwards compatibility with the default
> config, for attribute that commonly contain user input, hence
> suggesting the default config still escape User-Name/User-Password.

Ok, have a look at:

https://github.com/philmayers/freeradius-server/tree/escape-context

I've worked hard to break the changes up into a series of small commits 
that should be easy to review. It doesn't touch the 1-char xlats, and 
tries to be as minimal as possible.

The last few commits actually make use of the new argument to 
radius_xlat, specifically the SQL modules "safe-characters" is now 
per-instance, and not a static global variable. Which is good.

So, there are no changes to SQL escaping method - just the addition and 
basic use of escape function context/request arguments.

If you think this is ok and "pull" it, I'll work up patches next week to 
actually add driver-based SQL escaping as an option. I agree we should 
leave the default as-is.