CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 14:55:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Refactoring DBMS string escaping functions

Browse source
This commit is contained in:
Miroslav Stampar 2013-01-20 13:45:58 +01:00
parent 3b57fe2924
commit b4a55a809e
12 changed files with 52 additions and 206 deletions
Download patch file Download diff file Expand all files Collapse all files

20
plugins/dbms/mysql/syntax.py
View file

@ -6,10 +6,8 @@ See the file 'doc/COPYING' for copying permission
"""
import binascii
import re
from lib.core.convert import utf8encode
from lib.core.exception import SqlmapSyntaxException
from plugins.generic.syntax import Syntax as GenericSyntax
class Syntax(GenericSyntax):
@ -18,14 +16,12 @@ class Syntax(GenericSyntax):
@staticmethod
def escape(expression, quote=True):
if quote:
unescaped = expression
for item in re.findall(r"'[^']+'", expression, re.S):
try:
unescaped = unescaped.replace(item, "0x%s" % binascii.hexlify(item.strip("'")))
except UnicodeEncodeError:
unescaped = unescaped.replace(item, "CONVERT(0x%s USING utf8)" % "".join("%.2x" % ord(_) for _ in utf8encode(item.strip("'"))))
else:
unescaped = "0x%s" % binascii.hexlify(expression)
def escaper(value):
retVal = None
try:
retVal = "0x%s" % binascii.hexlify(value.strip("'"))
except UnicodeEncodeError:
retVal = "CONVERT(0x%s USING utf8)" % "".join("%.2x" % ord(_) for _ in utf8encode(value.strip("'")))
return retVal
return unescaped
return Syntax._escape(expression, quote, escaper)