2021-04-23 Fred Gleason <fredg@paravelsystems.com>

* Escaped all SQL identifiers in 'web/rdxport/'.
	* Replaced " with ' delimiters in all SQL literal strings in
	'web/rdxport/'.

Signed-off-by: Fred Gleason <fredg@paravelsystems.com>
This commit is contained in:
Fred Gleason
2021-04-23 13:55:42 -04:00
parent ac82d7356a
commit 703299899c
8 changed files with 54 additions and 48 deletions

View File

@@ -60,8 +60,8 @@ void Xport::DeleteAudio()
}
unlink(RDCut::pathName(cartnum,cutnum).toUtf8());
unlink((RDCut::pathName(cartnum,cutnum)+".energy").toUtf8());
QString sql=QString("delete from CUT_EVENTS where ")+
"CUT_NAME=\""+RDCut::cutName(cartnum,cutnum)+"\"";
QString sql=QString("delete from `CUT_EVENTS` where ")+
"`CUT_NAME`='"+RDCut::cutName(cartnum,cutnum)+"'";
RDSqlQuery *q=new RDSqlQuery(sql);
delete q;
SendNotification(RDNotification::CartType,RDNotification::ModifyAction,