summaryrefslogtreecommitdiffstats
path: root/lib/Plugins/SQLite3.cpp
diff options
context:
space:
mode:
Diffstat (limited to 'lib/Plugins/SQLite3.cpp')
-rw-r--r--lib/Plugins/SQLite3.cpp4
1 files changed, 2 insertions, 2 deletions
diff --git a/lib/Plugins/SQLite3.cpp b/lib/Plugins/SQLite3.cpp
index 74d2dcdb..499346f4 100644
--- a/lib/Plugins/SQLite3.cpp
+++ b/lib/Plugins/SQLite3.cpp
@@ -52,7 +52,7 @@ static bool is_string_safe(const char *str)
// it does not unescape escaped ones - I see lines ending with \ when I do it.
// I wonder whether this is a bug in SQLite, and whether using unescaped
// newlines is a danger with other SQL servers.
-// For now, I disabled newline escaping...
+// For now, I disabled newline escaping, and also allowed double quote.
const char *p = str;
while (*p)
{
@@ -63,7 +63,7 @@ static bool is_string_safe(const char *str)
// continue;
// }
if ((c < ' ' && c != '\n')
- || strchr("\\\"\'", c)
+ || strchr("\\\'", c) //was: "\\\"\'"
) {
error_msg("Probable SQL injection: '%s'", str);
return false;