From c659570289aaf6c47a829f1a3e6c77884d926072 Mon Sep 17 00:00:00 2001
From: Alexandr Chernov <kstchernov@gmail.com>
Date: Fri, 8 Dec 2023 16:54:56 +0100
Subject: [PATCH] GSvar: correctly escape test data in SQL

---
 src/cppNGSD/NGSD.cpp | 14 +++++---------
 src/cppNGSD/NGSD.h   |  2 +-
 2 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/src/cppNGSD/NGSD.cpp b/src/cppNGSD/NGSD.cpp
index 3c3f0d004..157601e34 100644
--- a/src/cppNGSD/NGSD.cpp
+++ b/src/cppNGSD/NGSD.cpp
@@ -8924,7 +8924,7 @@ QString NGSD::escapeText(QString text)
 	return db_->driver()->formatValue(f);
 }
 
-void NGSD::exportTable(const QString& table, QTextStream& out, QString where_clause, QMap<QString, QSet<int>> *sql_history) const
+void NGSD::exportTable(const QString& table, QTextStream& out, QString where_clause, QMap<QString, QSet<int>> *sql_history)
 {
 	if (!table.isEmpty())
 	{
@@ -8963,16 +8963,12 @@ void NGSD::exportTable(const QString& table, QTextStream& out, QString where_cla
 			for (int i=0; i<field_count; i++)
 			{
 				QString field_value = query.value(field_names[i]).toString();
-				if (((field_value.isEmpty()) || (field_value=="0")) && (table_info.fieldInfo()[i].is_nullable)) field_value = "NULL";
-				field_value = field_value.replace("'", "\\'");
-				field_value = field_value.replace("\"", "\\\"");
-				field_value = field_value.replace("\r", "\\r");
-				field_value = field_value.replace("\n", "\\n");
-				values.append(field_value);
+				if (((field_value.isEmpty()) || (field_value=="0")) && (table_info.fieldInfo()[i].is_nullable)) field_value = "NULL";                
+                values.append(escapeText(field_value));
 			}
 
-			QString insert_query =  "('" + values.join("', '") + "')";
-			insert_query = insert_query.replace("'NULL'", "NULL");
+            QString insert_query =  "(" + values.join(", ") + ")";
+            insert_query = insert_query.replace("'NULL'", "NULL");
 			out << insert_query;
 
 			if (row_count>=1000)
diff --git a/src/cppNGSD/NGSD.h b/src/cppNGSD/NGSD.h
index 219f071a4..598daaf60 100644
--- a/src/cppNGSD/NGSD.h
+++ b/src/cppNGSD/NGSD.h
@@ -675,7 +675,7 @@ Q_OBJECT
 	QString escapeText(QString text);
 
 	///Creates a SQL dump for a given table. sql_history is a hash table that keeps track of already exported records: table name > exported IDs set.
-	void exportTable(const QString& table, QTextStream& out, QString where_clause = "", QMap<QString, QSet<int>> *sql_history = nullptr) const;	
+    void exportTable(const QString& table, QTextStream& out, QString where_clause = "", QMap<QString, QSet<int>> *sql_history = nullptr);
 
 	///Creates a DBTable with data from an SQL query.
 	DBTable createTable(QString table, QString query, int pk_col_index=0);