diff --git a/ChangeLog b/ChangeLog index ec536ea9..c612e8af 100644 --- a/ChangeLog +++ b/ChangeLog @@ -21567,3 +21567,7 @@ * Escaped all SQL identifiers in 'utils/rddgimport/'. * Replaced " with ' delimiters in all SQL literal strings in 'utils/rddgimport/'. +2021-04-23 Fred Gleason + * Escaped all SQL identifiers in 'utils/rdexport/'. + * Replaced " with ' delimiters in all SQL literal strings in + 'utils/rdexport/'. diff --git a/utils/rdexport/rdexport.cpp b/utils/rdexport/rdexport.cpp index 643af53a..fa6c5436 100644 --- a/utils/rdexport/rdexport.cpp +++ b/utils/rdexport/rdexport.cpp @@ -327,10 +327,10 @@ void MainObject::ExportTitle(const QString &title) QString sql; RDSqlQuery *q; - sql=QString("select NUMBER from CART where ")+ - "(TITLE=\""+RDEscapeString(title)+"\")&&"+ - QString().sprintf("(TYPE=%u) ",RDCart::Audio)+ - "order by NUMBER"; + sql=QString("select `NUMBER` from `CART` where ")+ + "(`TITLE`='"+RDEscapeString(title)+"')&&"+ + QString().sprintf("(`TYPE`=%u) ",RDCart::Audio)+ + "order by `NUMBER`"; q=new RDSqlQuery(sql); while(q->next()) { ExportCart(q->value(0).toUInt()); @@ -344,10 +344,10 @@ void MainObject::ExportGroup(const QString &groupname) QString sql; RDSqlQuery *q; - sql=QString("select NUMBER from CART where ")+ - "(GROUP_NAME=\""+RDEscapeString(groupname)+"\")&&"+ - QString().sprintf("(TYPE=%u) ",RDCart::Audio)+ - "order by NUMBER"; + sql=QString("select `NUMBER` from `CART` where ")+ + "(`GROUP_NAME`='"+RDEscapeString(groupname)+"')&&"+ + QString().sprintf("(`TYPE`=%u) ",RDCart::Audio)+ + "order by `NUMBER`"; q=new RDSqlQuery(sql); while(q->next()) { ExportCart(q->value(0).toUInt()); @@ -361,9 +361,9 @@ void MainObject::ExportSchedCode(const QString &schedcode) QString sql; RDSqlQuery *q; - sql=QString("select CART_NUMBER from CART_SCHED_CODES where ")+ - "SCHED_CODE=\""+RDEscapeString(schedcode)+"\" "+ - "order by CART_NUMBER"; + sql=QString("select `CART_NUMBER` from `CART_SCHED_CODES` where ")+ + "`SCHED_CODE`='"+RDEscapeString(schedcode)+"' "+ + "order by `CART_NUMBER`"; q=new RDSqlQuery(sql); while(q->next()) { ExportCart(q->value(0).toUInt()); @@ -379,8 +379,8 @@ void MainObject::ExportCart(unsigned cartnum) RDSqlQuery *q; if(cart->exists()&&(cart->type()==RDCart::Audio)) { - sql=QString().sprintf("select CUT_NAME from CUTS where CART_NUMBER=%u", - cartnum); + sql=QString("select `CUT_NAME` from `CUTS` where ")+ + QString().sprintf("`CART_NUMBER`=%u",cartnum); q=new RDSqlQuery(sql); while(q->next()) { RDCut *cut=new RDCut(q->value(0).toString());