2021-04-19 Fred Gleason <fredg@paravelsystems.com>

* Escaped all SQL identifiers in 'rdlibrary/'.
	* Replaced " with ' delimiters in all SQL literal strings in
	'rdlibrary/'.

Signed-off-by: Fred Gleason <fredg@paravelsystems.com>
This commit is contained in:
Fred Gleason
2021-04-19 20:11:16 -04:00
parent 220ead0ccd
commit ad56584012
8 changed files with 124 additions and 125 deletions

View File

@@ -749,9 +749,9 @@ void EditCart::okData()
return;
}
if(!rda->system()->allowDuplicateCartTitles()) {
sql=QString("select NUMBER from CART where ")+
"(TITLE=\""+RDEscapeString(rdcart_controls.title_edit->text())+"\") &&"+
QString().sprintf("(NUMBER!=%u)",rdcart_cart->number());
sql=QString("select `NUMBER` from `CART` where ")+
"(`TITLE`='"+RDEscapeString(rdcart_controls.title_edit->text())+"') &&"+
QString().sprintf("(`NUMBER`!=%u)",rdcart_cart->number());
q=new RDSqlQuery(sql);
if(q->first()) {
QMessageBox::warning(this,tr("Duplicate Title"),