Bug 244290 - [DB] Trailing backslash is not escaped
Summary: [DB] Trailing backslash is not escaped
Status: CLOSED FIXED
Alias: None
Product: EMF
Classification: Modeling
Component: cdo.db (show other bugs)
Version: 2.0   Edit
Hardware: PC Windows XP
: P1 normal (vote)
Target Milestone: M4   Edit
Assignee: Stefan Winkler CLA
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on: 214487
Blocks:
  Show dependency tree
 
Reported: 2008-08-15 08:50 EDT by Stefan Winkler CLA
Modified: 2010-06-29 04:18 EDT (History)
1 user (show)

See Also:
stepper: review+


Attachments
TestCase (3.82 KB, patch)
2008-11-22 04:09 EST, Stefan Winkler CLA
no flags Details | Diff
Testcase + Patch (12.57 KB, patch)
2008-11-25 08:01 EST, Stefan Winkler CLA
no flags Details | Diff
Resynced prev. patch w/ HEAD (11.26 KB, patch)
2008-11-28 07:40 EST, Stefan Winkler CLA
no flags Details | Diff
Patch v4 - ready to be committed (11.23 KB, patch)
2008-11-28 11:48 EST, Eike Stepper CLA
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Winkler CLA 2008-08-15 08:50:27 EDT
Build ID: I20080617-2000 (CDO, Net4j = CVS HEAD)

Steps To Reproduce:
// using MySQL DB-Store (native, not hibernate!)

@Test
public void testStoreStringBackslash() {
  CDOResource resource = transaction.getOrCreateResource("/test");
	
  Company e =Model1Factory.eINSTANCE.createCompany();
  e.setName("foobar\\");
  // this escapes only the string!
  // resulting string only contains one backslash

  resource.getContents().add(e);
  transaction.commit();
}



More information:
results in 

I did not check about other Databases (Derby, HSQLDB).
However, this leads to DBType.appendValue to generate '... foobar\' which seems incompatible with MySQL query.
Comment 1 Stefan Winkler CLA 2008-11-22 03:56:27 EST
Seems to work in HSQLDB - attached TestCase.

http://www.jguru.com/faq/view.jsp?EID=8881 says:

----
SELECT * FROM BIRDS  
  WHERE SPECIES='Williamson's Sapsucker'

In this case, the apostrophe in "Williamson's" is going to cause a problem for the database because SQL will interpret it as a string delimiter. It is not good enough to use the C-style escape \', because that substitution would be made by the Java compiler before the string is sent to the database.

Different flavors of SQL provide different methods to deal with this situation. JDBC abstracts these methods and provides a solution that works for all databases. With JDBC you could write the SQL as follows:

Statement statement = // obtain reference to a Statement
statement.executeQuery(
  "SELECT * FROM BIRDS  WHERE SPECIES='Williamson/'s Sapsucker' {escape '/'}");

The clause in curly braces, namely {escape '/'}, is special syntax used to inform JDBC drivers what character the programmer has chosen as an escape character. The forward slash used as the SQL escape has no special meaning to the Java compiler; this escape sequence is interpreted by the JDBC driver and translated into database-specific SQL before the SQL command is issued to the database.
----

Will try with MySQL on Monday, maybe it's a good idea to use the JDBC escape notation as cited above.
Comment 2 Stefan Winkler CLA 2008-11-22 04:09:54 EST
Created attachment 118543 [details]
TestCase

TestCase for string storing issues.
Comment 3 Stefan Winkler CLA 2008-11-25 08:01:44 EST
Created attachment 118657 [details]
Testcase + Patch

- Testcase from previous patch is included
- Moved string escaping logic to DBAdapter

-> Now runs with all three database backends.
Comment 4 Eike Stepper CLA 2008-11-28 03:15:48 EST
Stefan Can you please resolve the merge conflicts against HEAD (test case)...
Comment 5 Stefan Winkler CLA 2008-11-28 07:40:36 EST
Created attachment 118990 [details]
Resynced prev. patch w/ HEAD
Comment 6 Eike Stepper CLA 2008-11-28 11:48:23 EST
Created attachment 119026 [details]
Patch v4 - ready to be committed

My only concern is that the appendValue method looks very similar in all concrete DBAdapters. Cold that be abstracted somehow? I leave it up to you...
Comment 7 Stefan Winkler CLA 2008-12-01 08:38:05 EST
Committed to HEAD.

I see the argument of abstracting the common code. But then again, I don't know which special cases will pop up in the future for single databases. This way the code stays more changeable for single databases and we can react to special cases more efficiently.
Comment 8 Eike Stepper CLA 2008-12-01 08:39:57 EST
Agreed ;-)
Comment 9 Eike Stepper CLA 2008-12-19 12:36:15 EST
Fix available in CDO 2.0.0M4
Comment 10 Eike Stepper CLA 2009-06-27 11:46:33 EDT
Generally available.