Bug #5268 Command.Prepare does not escape String correctly for back-shash

• Submitted: 27 Aug 2004 21:51
• Modified: 8 Sep 2004 19:29
• Reporter: Lon Palmer
• Status: Closed
• Category: Connector / NET
• Severity: S2 (Serious)
• Version: ByteFX .76
• OS: Windows (Win XP)
• Assigned to: Reggie Burnett
• CPU Architecture: Any

[27 Aug 2004 21:51] Lon Palmer

Description:
Creating an insert command with an @parameter set to Ascii String populated with a string containing a back slash character is not escaped properly generating an SQL error.

Specifically, I've created an insert statement that is populated with a windows directory ( which of course contains a back slash ).  When I call ExecuteNonQuery I receive an exception asking me to check my sql syntax near the backslash.  If I manually escape the back slash the sql works.

When debugging my application, I've drilled down to the parameter in question.  The debugger shows the 'Value' property of the parameter as @"C:\".  Again if I escape the back slashes myself it works.

How to repeat:
Create a parameterized command with string values.  Add a parameter that is of DbType.Ascii to the command.  Set it's value to "C:\".  Prepare the command and finally ExecuteNonQuery.  The back-slash is not correctly escaped.

Suggested fix:
When a user sets the .Value of a parameter, and that parameter is essentially a string, escape all necessary characters including ", \, ', etc.

Kudos for the fine work so far.

[8 Sep 2004 19:29] Reggie Burnett

Thank you for taking the time to report a problem.  Unfortunately
you are not using a current version of the product your reported a
problem with -- the problem might already be fixed. Please download
a new version from http://www.mysql.com/downloads/

If you are able to reproduce the bug with one of the latest versions,
please change the version on this bug report to the version you
tested and change the status back to "Open".  Again, thank you for
your continued support of MySQL.

Additional info:

This is fixed in beta 1