Untitled

C SQL Query building made easy

GString *acc_protocol = g_string_new(acc->prpl->name);

GString *acc_handle = g_string_new(acc->user);

GString *acc_password = g_string_new(acc->pass);

GString *acc_tag = g_string_new(acc->tag);

g_string_printf(q, "INSERT INTO accounts (user, protocol, handle, password, autoconnect, tag) values (%ld, ", user_id);

g_string_append(q,"'");

append_mysql_escaped_param(q, buf, acc_protocol);

g_string_append(q,"', '");

append_mysql_escaped_param(q, buf, acc_handle);

g_string_append(q,"', '");

append_mysql_escaped_param(q, buf, acc_password);

g_string_append(q,"', '");

g_string_append(q, atoi(acc->auto_connect));

g_string_append(q,"', '");

append_mysql_escaped_param(q, buf, acc_tag);

g_string_append(q,"') on duplicate key UPDATE password='");

append_mysql_escaped_param(q, buf, acc_password);

g_string_append(q,"', autoconnect='");

g_string_append(q, atoi(acc->auto_connect));

g_string_append(q,"', tag='");

append_mysql_escaped_param(q, buf, acc_tag);

g_string_append(q,"'");

 

g_string_free(acc_handle);

g_string_free(acc_password);

g_string_free(acc_protocol);

g_string_free(acc_tag);

 

mysql_real_query(mysql);

    num_rows =  mysql_affected_rows(mysql);

    ....

/// .... mysql processing here ...

       

static void append_mysql_escaped_param(GString *query, GString *buffer, GString *param){

    g_string_set_size(buffer, param->len*2+1);

    mysql_real_escape_string(mysql, buffer->str, param->str, param->len);

    g_string_append(query, buffer->str);

}

       

char querystring[]="INSERT INTO accounts (user, protocol, handle, password, autoconnect, tag) values ({param_user_id}, {param_protocol}, {param_handle}, {param_password}, {param_autoconnect}, {param_tag});"

parameterizeQuery(querystring, "user_id", user_id);

parameterizeQuery(querystring, "protocol", acc_protocol);

//do this for all remaining fields

g_string_printf(q, querystring);

       

void parameterizeQuery(char stringofquery[], char parameterstring[], char parametervalue[])

{

    //PSEUDO-CODE: stringofquery.str_replace("{param_"+parameterstring+"}", g_string_mysql_escape_param(parametervalue));

}