fixes #20153; do not escape _ for mysql [backport] (#20164)

* fixes #20153; do not escape `_` for mysql * add a test * Update db_mysql.nim * Update tdb_mysql.nim Co-authored-by: Clay Sweetser <Varriount@users.noreply.github.com>
nim-lang · Aug 5, 2022 · 3bd935f · 3bd935f
1 parent 3fef2fd
commit 3bd935f
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/lib/impure/db_mysql.nim b/lib/impure/db_mysql.nim
@@ -117,7 +117,7 @@ when false:
     discard mysql_stmt_close(stmt)
 
 proc dbQuote*(s: string): string =
-  ## DB quotes the string.
+  ## DB quotes the string. Note that this doesn't escape `%` and `_`.
   result = newStringOfCap(s.len + 2)
   result.add "'"
   for c in items(s):
@@ -132,7 +132,6 @@ proc dbQuote*(s: string): string =
     of '"': result.add "\\\""
     of '\'': result.add "\\'"
     of '\\': result.add "\\\\"
-    of '_': result.add "\\_"
     else: result.add c
   add(result, '\'')
 

diff --git a/tests/stdlib/tdb_mysql.nim b/tests/stdlib/tdb_mysql.nim
@@ -0,0 +1,4 @@
+import std/db_mysql
+
+doAssert dbQuote("SELECT * FROM foo WHERE col1 = 'bar_baz'") == "'SELECT * FROM foo WHERE col1 = \\'bar_baz\\''"
+doAssert dbQuote("SELECT * FROM foo WHERE col1 LIKE '%bar_baz%'") == "'SELECT * FROM foo WHERE col1 LIKE \\'%bar_baz%\\''"