Skip to content

Commit f126e37

Browse files
author
jef
committedApr 6, 2010
followup r13227
git-svn-id: http://svn.osgeo.org/qgis/trunk/qgis@13261 c8812cc2-4d05-0410-92ff-de0c093fc19c
·
final-1_7_1final-1_7_0
1 parent 648a49c commit f126e37

File tree

2 files changed

+49
-74
lines changed

2 files changed

+49
-74
lines changed
 

‎src/core/qgscoordinatereferencesystem.cpp

Lines changed: 47 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,7 @@ bool QgsCoordinateReferenceSystem::loadFromDb( QString db, QString expression, Q
208208
is_geo integer NOT NULL);
209209
*/
210210

211-
QString mySql = "select srs_id,description,projection_acronym,ellipsoid_acronym,parameters,srid,auth_name||':'||auth_id,is_geo from tbl_srs where " + expression + "='" + value + "'";
211+
QString mySql = "select srs_id,description,projection_acronym,ellipsoid_acronym,parameters,srid,auth_name||':'||auth_id,is_geo from tbl_srs where " + expression + "=" + quotedValue( value );
212212
myResult = sqlite3_prepare( myDatabase, mySql.toUtf8(), mySql.toUtf8().length(), &myPreparedStatement, &myTail );
213213
// XXX Need to free memory from the error msg if one is set
214214
if ( myResult == SQLITE_OK && sqlite3_step( myPreparedStatement ) == SQLITE_ROW )
@@ -343,14 +343,14 @@ bool QgsCoordinateReferenceSystem::createFromProj4( const QString theProj4String
343343
// *** Matching on descriptions feels iffy. Different projs can have same description. Homann ***
344344
// if ( !mDescription.trimmed().isEmpty() )
345345
//{
346-
// myRecord = getRecord( "select * from tbl_srs where description='" + mDescription.trimmed() + "'" );
346+
// myRecord = getRecord( "select * from tbl_srs where description=" + quotedValue( mDescription.trimmed() ) );
347347
//}
348348

349349
/*
350350
* - if the above does not match perform a whole text search on proj4 string (if not null)
351351
*/
352352
// QgsDebugMsg( "wholetext match on name failed, trying proj4string match" );
353-
myRecord = getRecord( "select * from tbl_srs where parameters='" + theProj4String.trimmed() + "'" );
353+
myRecord = getRecord( "select * from tbl_srs where parameters=" + quotedValue( theProj4String.trimmed() ) );
354354
if ( !myRecord.empty() )
355355
{
356356
mySrsId = myRecord["srs_id"].toLong();
@@ -394,7 +394,7 @@ bool QgsCoordinateReferenceSystem::createFromProj4( const QString theProj4String
394394
myStart2 = myLat2RegExp.indexIn( theProj4String, myStart2 );
395395
theProj4StringModified.replace( myStart2 + LAT_PREFIX_LEN, myLength2 - LAT_PREFIX_LEN, lat1Str );
396396
QgsDebugMsg( "trying proj4string match with swapped lat_1,lat_2" );
397-
myRecord = getRecord( "select * from tbl_srs where parameters='" + theProj4StringModified.trimmed() + "'" );
397+
myRecord = getRecord( "select * from tbl_srs where parameters=" + quotedValue( theProj4StringModified.trimmed() ) );
398398
if ( !myRecord.empty() )
399399
{
400400
// Success! We have found the proj string by swapping the lat_1 and lat_2
@@ -435,39 +435,39 @@ bool QgsCoordinateReferenceSystem::createFromProj4( const QString theProj4String
435435
if ( mIsValidFlag )
436436
{
437437
// but the proj.4 parsed string might already be in our database
438-
myRecord = getRecord( "select * from tbl_srs where parameters='" + toProj4() + "'" );
438+
myRecord = getRecord( "select * from tbl_srs where parameters=" + quotedValue( toProj4() ) );
439439
if ( myRecord.empty() )
440440
{
441-
// It's not, so try to add it
442-
QgsDebugMsg( "Projection appears to be valid. Save to database!" );
443-
mIsValidFlag = saveAsUserCRS();
444-
445-
if ( mIsValidFlag )
446-
{
447-
// but validate that it's there afterwards
448-
myRecord = getRecord( "select * from tbl_srs where parameters='" + toProj4() + "'" );
449-
}
441+
// It's not, so try to add it
442+
QgsDebugMsg( "Projection appears to be valid. Save to database!" );
443+
mIsValidFlag = saveAsUserCRS();
444+
445+
if ( mIsValidFlag )
446+
{
447+
// but validate that it's there afterwards
448+
myRecord = getRecord( "select * from tbl_srs where parameters=" + quotedValue( toProj4() ) );
449+
}
450450
}
451451

452452
if ( !myRecord.empty() )
453453
{
454-
// take the srid from the record
455-
mySrsId = myRecord["srs_id"].toLong();
456-
QgsDebugMsg( "proj4string match search for srsid returned srsid: " + QString::number( mySrsId ) );
457-
if ( mySrsId > 0 )
458-
{
459-
createFromSrsId( mySrsId );
460-
}
461-
else
462-
{
463-
QgsDebugMsg( QString( "invalid srid %1 found" ).arg( mySrsId ) );
464-
mIsValidFlag = false;
465-
}
454+
// take the srid from the record
455+
mySrsId = myRecord["srs_id"].toLong();
456+
QgsDebugMsg( "proj4string match search for srsid returned srsid: " + QString::number( mySrsId ) );
457+
if ( mySrsId > 0 )
458+
{
459+
createFromSrsId( mySrsId );
460+
}
461+
else
462+
{
463+
QgsDebugMsg( QString( "invalid srid %1 found" ).arg( mySrsId ) );
464+
mIsValidFlag = false;
465+
}
466466
}
467467
else
468468
{
469-
QgsDebugMsg( "Couldn't find newly added proj string?" );
470-
mIsValidFlag = false;
469+
QgsDebugMsg( "Couldn't find newly added proj string?" );
470+
mIsValidFlag = false;
471471
}
472472
}
473473
}
@@ -802,8 +802,9 @@ long QgsCoordinateReferenceSystem::findMatchingProj()
802802
int myResult;
803803

804804
// Set up the query to retrieve the projection information needed to populate the list
805-
QString mySql = QString( "select srs_id,parameters from tbl_srs where projection_acronym='" +
806-
mProjectionAcronym + "' and ellipsoid_acronym='" + mEllipsoidAcronym + "'" );
805+
QString mySql = QString( "select srs_id,parameters from tbl_srs where projection_acronym=%1 and ellipsoid_acronym=%2" )
806+
.arg( quotedValue( mProjectionAcronym ) )
807+
.arg( quotedValue( mEllipsoidAcronym ) );
807808
// Get the full path name to the sqlite3 spatial reference database.
808809
QString myDatabaseFileName = QgsApplication::srsDbFilePath();
809810

@@ -815,7 +816,7 @@ long QgsCoordinateReferenceSystem::findMatchingProj()
815816
}
816817

817818
myResult = sqlite3_prepare( myDatabase, mySql.toUtf8(), mySql.toUtf8().length(), &myPreparedStatement, &myTail );
818-
// XXX Need to free memory from the error msg if one is set
819+
// XXX Need to free memory from the error msg if one is set
819820
if ( myResult == SQLITE_OK )
820821
{
821822

@@ -854,7 +855,7 @@ long QgsCoordinateReferenceSystem::findMatchingProj()
854855
}
855856

856857
myResult = sqlite3_prepare( myDatabase, mySql.toUtf8(), mySql.toUtf8().length(), &myPreparedStatement, &myTail );
857-
// XXX Need to free memory from the error msg if one is set
858+
// XXX Need to free memory from the error msg if one is set
858859
if ( myResult == SQLITE_OK )
859860
{
860861

@@ -1233,21 +1234,21 @@ bool QgsCoordinateReferenceSystem::saveAsUserCRS()
12331234
if ( getRecordCount() == 0 )
12341235
{
12351236
mySql = "insert into tbl_srs (srs_id,description,projection_acronym,ellipsoid_acronym,parameters,is_geo) values ("
1236-
+ QString::number( USER_CRS_START_ID ) + ",'"
1237-
+ sqlSafeString( myName ) + "','"
1238-
+ projectionAcronym() + "','"
1239-
+ ellipsoidAcronym() + "','"
1240-
+ sqlSafeString( toProj4() )
1237+
+ QString::number( USER_CRS_START_ID )
1238+
+ "," + quotedValue( myName )
1239+
+ "," + quotedValue( projectionAcronym() )
1240+
+ "," + quotedValue( ellipsoidAcronym() )
1241+
+ "," + quotedValue( toProj4() )
12411242
+ "',0)"; // <-- is_geo shamelessly hard coded for now
12421243
}
12431244
else
12441245
{
1245-
mySql = "insert into tbl_srs (description,projection_acronym,ellipsoid_acronym,parameters,is_geo) values ('"
1246-
+ sqlSafeString( myName ) + "','"
1247-
+ projectionAcronym() + "','"
1248-
+ ellipsoidAcronym() + "','"
1249-
+ sqlSafeString( toProj4() )
1250-
+ "',0)"; // <-- is_geo shamelessly hard coded for now
1246+
mySql = "insert into tbl_srs (description,projection_acronym,ellipsoid_acronym,parameters,is_geo) values ("
1247+
+ quotedValue( myName )
1248+
+ "," + quotedValue( projectionAcronym() )
1249+
+ "," + quotedValue( ellipsoidAcronym() )
1250+
+ "," + quotedValue( toProj4() )
1251+
+ ",0)"; // <-- is_geo shamelessly hard coded for now
12511252
}
12521253
sqlite3 *myDatabase;
12531254
const char *myTail;
@@ -1305,34 +1306,8 @@ long QgsCoordinateReferenceSystem::getRecordCount()
13051306
return myRecordCount;
13061307
}
13071308

1308-
const QString QgsCoordinateReferenceSystem::sqlSafeString( const QString theSQL )
1309+
QString QgsCoordinateReferenceSystem::quotedValue( QString value )
13091310
{
1310-
1311-
QString myRetval;
1312-
QChar *it = ( QChar * )theSQL.unicode();
1313-
for ( int i = 0; i < theSQL.length(); i++ )
1314-
{
1315-
if ( *it == '\"' )
1316-
{
1317-
myRetval += "\\\"";
1318-
}
1319-
else if ( *it == '\'' )
1320-
{
1321-
myRetval += "\\'";
1322-
}
1323-
else if ( *it == '\\' )
1324-
{
1325-
myRetval += "\\\\";
1326-
}
1327-
else if ( *it == '%' )
1328-
{
1329-
myRetval += "\\%";
1330-
}
1331-
else
1332-
{
1333-
myRetval += *it;
1334-
}
1335-
it++;
1336-
}
1337-
return myRetval;
1311+
value.replace( "'", "''" );
1312+
return value.prepend( "'" ).append( "'" );
13381313
}

‎src/core/qgscoordinatereferencesystem.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -405,8 +405,8 @@ class CORE_EXPORT QgsCoordinateReferenceSystem
405405
//! Helper for getting number of user CRS already in db
406406
long getRecordCount();
407407

408-
//! Helper for sql-safin strings
409-
const QString sqlSafeString( const QString theSQL );
408+
//! Helper for sql-safe value quoting
409+
QString quotedValue( QString value );
410410

411411
void *mCRS;
412412

0 commit comments

Comments
 (0)
Please sign in to comment.