{"action":"opened","issue":{"url":"https://api.github.com/repos/0c0c0f/security/issues/1","repository_url":"https://api.github.com/repos/0c0c0f/security","labels_url":"https://api.github.com/repos/0c0c0f/security/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/0c0c0f/security/issues/1/comments","events_url":"https://api.github.com/repos/0c0c0f/security/issues/1/events","html_url":"https://github.com/0c0c0f/security/issues/1","id":299795400,"number":1,"title":"SQLUtil","user":{"login":"zhutougg","id":18353609,"avatar_url":"https://avatars2.githubusercontent.com/u/18353609?v=4","gravatar_id":"","url":"https://api.github.com/users/zhutougg","html_url":"https://github.com/zhutougg","followers_url":"https://api.github.com/users/zhutougg/followers","following_url":"https://api.github.com/users/zhutougg/following{/other_user}","gists_url":"https://api.github.com/users/zhutougg/gists{/gist_id}","starred_url":"https://api.github.com/users/zhutougg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zhutougg/subscriptions","organizations_url":"https://api.github.com/users/zhutougg/orgs","repos_url":"https://api.github.com/users/zhutougg/repos","events_url":"https://api.github.com/users/zhutougg/events{/privacy}","received_events_url":"https://api.github.com/users/zhutougg/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-02-23T17:48:14Z","updated_at":"2018-02-23T17:48:14Z","closed_at":null,"author_association":"NONE","body":"```\r\npackage com.zhutougg.db;\r\n\r\nimport java.nio.ByteBuffer;\r\nimport java.nio.CharBuffer;\r\nimport java.nio.charset.Charset;\r\nimport java.sql.SQLException;\r\n\r\nimport com.mysql.cj.core.util.StringUtils;\r\n\r\npublic class SQLUtil {\r\n\r\n\tpublic static String setString(String x)throws SQLException {\r\n\t\tint stringLength = x.length();\r\n\t\tString parameterAsString = x;\r\n\t\tboolean needsQuoted = true;\r\n\r\n\t\tif (isEscapeNeededForString(x, stringLength)) {\r\n\t\t\tneedsQuoted = false; // saves an allocation later\r\n\r\n\t\t\tStringBuilder buf = new StringBuilder((int) (x.length() * 1.1));\r\n\r\n\t\t\tbuf.append('\\'');\r\n\r\n\t\t\tfor (int i = 0; i < stringLength; ++i) {\r\n\t\t\t\tchar c = x.charAt(i);\r\n\r\n\t\t\t\tswitch (c) {\r\n\t\t\t\tcase 0: /* Must be escaped for 'mysql' */\r\n\t\t\t\t\tbuf.append('\\\\');\r\n\t\t\t\t\tbuf.append('0');\r\n\r\n\t\t\t\t\tbreak;\r\n\r\n\t\t\t\tcase '\\n': /* Must be escaped for logs */\r\n\t\t\t\t\tbuf.append('\\\\');\r\n\t\t\t\t\tbuf.append('n');\r\n\r\n\t\t\t\t\tbreak;\r\n\r\n\t\t\t\tcase '\\r':\r\n\t\t\t\t\tbuf.append('\\\\');\r\n\t\t\t\t\tbuf.append('r');\r\n\r\n\t\t\t\t\tbreak;\r\n\r\n\t\t\t\tcase '\\\\':\r\n\t\t\t\t\tbuf.append('\\\\');\r\n\t\t\t\t\tbuf.append('\\\\');\r\n\r\n\t\t\t\t\tbreak;\r\n\r\n\t\t\t\tcase '\\'':\r\n\t\t\t\t\tbuf.append('\\\\');\r\n\t\t\t\t\tbuf.append('\\'');\r\n\r\n\t\t\t\t\tbreak;\r\n\r\n\t\t\t\tcase '\"': /* Better safe than sorry */\r\n\t\t\t\t\tbuf.append('\"');\r\n\t\t\t\t\tbreak;\r\n\r\n\t\t\t\tcase '\\032': /* This gives problems on Win32 */\r\n\t\t\t\t\tbuf.append('\\\\');\r\n\t\t\t\t\tbuf.append('Z');\r\n\r\n\t\t\t\t\tbreak;\r\n\r\n\t\t\t\tcase '\\u00a5':\r\n\t\t\t\tcase '\\u20a9':\r\n\t\t\t\t\t// escape characters interpreted as backslash by mysql\r\n\t\t\t\t\tif (Charset.forName(\"UTF-8\").newEncoder() != null) {\r\n\t\t\t\t\t\tCharBuffer cbuf = CharBuffer.allocate(1);\r\n\t\t\t\t\t\tByteBuffer bbuf = ByteBuffer.allocate(1);\r\n\t\t\t\t\t\tcbuf.put(c);\r\n\t\t\t\t\t\tcbuf.position(0);\r\n\t\t\t\t\t\tCharset.forName(\"UTF-8\").newEncoder()\r\n\t\t\t\t\t\t\t\t.encode(cbuf, bbuf, true);\r\n\t\t\t\t\t\tif (bbuf.get(0) == '\\\\') {\r\n\t\t\t\t\t\t\tbuf.append('\\\\');\r\n\t\t\t\t\t\t}\r\n\t\t\t\t\t}\r\n\t\t\t\t\tbuf.append(c);\r\n\t\t\t\t\tbreak;\r\n\r\n\t\t\t\tdefault:\r\n\t\t\t\t\tbuf.append(c);\r\n\t\t\t\t}\r\n\t\t\t}\r\n\r\n\t\t\tbuf.append('\\'');\r\n\r\n\t\t\tparameterAsString = buf.toString();\r\n\t\t}\r\n\r\n\t\tbyte[] parameterAsBytes = null;\r\n\r\n\t\tif (needsQuoted) {\r\n\t\t\tparameterAsBytes = StringUtils.getBytesWrapped(parameterAsString,\r\n\t\t\t\t\t'\\'', '\\'', \"UTF-8\");\r\n\t\t} else {\r\n\t\t\tparameterAsBytes = StringUtils.getBytes(parameterAsString, \"UTF-8\");\r\n\t\t}\r\n\t\treturn new String(parameterAsBytes);\r\n\r\n\t}\r\n\r\n\tprivate static boolean isEscapeNeededForString(String x, int stringLength) {\r\n\t\tboolean needsHexEscape = false;\r\n\r\n\t\tfor (int i = 0; i < stringLength; ++i) {\r\n\t\t\tchar c = x.charAt(i);\r\n\r\n\t\t\tswitch (c) {\r\n\t\t\tcase 0: /* Must be escaped for 'mysql' */\r\n\r\n\t\t\t\tneedsHexEscape = true;\r\n\t\t\t\tbreak;\r\n\r\n\t\t\tcase '\\n': /* Must be escaped for logs */\r\n\t\t\t\tneedsHexEscape = true;\r\n\r\n\t\t\t\tbreak;\r\n\r\n\t\t\tcase '\\r':\r\n\t\t\t\tneedsHexEscape = true;\r\n\t\t\t\tbreak;\r\n\r\n\t\t\tcase '\\\\':\r\n\t\t\t\tneedsHexEscape = true;\r\n\r\n\t\t\t\tbreak;\r\n\r\n\t\t\tcase '\\'':\r\n\t\t\t\tneedsHexEscape = true;\r\n\r\n\t\t\t\tbreak;\r\n\r\n\t\t\tcase '\"': /* Better safe than sorry */\r\n\t\t\t\tneedsHexEscape = true;\r\n\r\n\t\t\t\tbreak;\r\n\r\n\t\t\tcase '\\032': /* This gives problems on Win32 */\r\n\t\t\t\tneedsHexEscape = true;\r\n\t\t\t\tbreak;\r\n\t\t\t}\r\n\r\n\t\t\tif (needsHexEscape) {\r\n\t\t\t\tbreak; // no need to scan more\r\n\t\t\t}\r\n\t\t}\r\n\t\treturn needsHexEscape;\r\n\t}\r\n}\r\n```\r\n\r\n以上代码改写自com.mysql.cj.jdbc.PreparedStatement\r\n\r\n\r\n\r\n"}}
{"actor":{"display_login":"zhutougg"}}