adding SQL string escaping to the token before its merged with the query

2013-08-05 15:28:46 -04:00 · 2013-08-05 15:28:46 -04:00 · 1096842dd6
parent 04b8604d4b
commit 1096842dd6
1 changed files with 1 additions and 1 deletions
--- a/utils/websockify
+++ b/utils/websockify
@ -285,7 +285,7 @@ Traffic Legend:
        targets = {}
        db=MySQLdb.connect(passwd=sqlconfig['passwd'],db=sqlconfig['db'],user=sqlconfig['user'])
        c=db.cursor()
-        c.execute(sqlconfig['match_query'].replace('_TOKEN_', token))
+        c.execute(sqlconfig['match_query'].replace('_TOKEN_', db.escape_string(token)))
        results = c.fetchone()
        targets[token] = results[0]
        c.close()