Question

对于Progress 4GL / ABL的php http://php.net/manual/en/function.mysql-real-escape-string.php或者Progress社区中的最佳实践是否存在一个类似的过程，用于将已清理的文本写入外部和不受信任的实体（网站，mysql服务器和API）？

QUOTE或QUERY-PREPARE函数不起作用，因为它们为Progress的动态查询而不是外部实体的文本进行清理。

Answer 1

与你引用的例子最接近的类似是编写一个执行此操作的函数：

 DEFINE VARIABLE ch-escape-chars AS CHARACTER    NO-UNDO.
 DEFINE VARIABLE ch-string       AS CHARACTER    NO-UNDO.
 DEFINE VARIABLE i-cnt           AS INTEGER      NO-UNDO.

 DO i-cnt = 1 TO LENGTH(ch-escape-char):

     ch-string = REPLACE(ch-string,
                         SUBSTRING(ch-escape-char, i-cnt, 1),
                         "~~" + SUBSTRING(ch-escape-char, i-cnt, 1)).

 END.

其中

 ch-escape-chars are the characters you want escape'd. 
 ch-string is the incoming string.
 "~~" is the esacap'd escape character.

Answer 2

听起来像你自己的滚动是唯一的方法。为了我的目的，我模拟了mysql_real_escape_string函数

/* TODO progress auto changes all ASC(0) characters to space or ASC(20) in a non db string. */
/* the backslash needs to go first */
/* there is no concept of static vars in progress (non class) so global variables */
DEFINE VARIABLE cEscape AS CHARACTER EXTENT INITIAL [
 "~\",
 /*"~000",*/
 "~n",
 "~r",
 "'",
 "~""
 ]
 .
DEFINE VARIABLE cReplace AS CHARACTER EXTENT INITIAL [
 "\\",
 /*"\0",*/
 "\n",
 "\r",
 "\'",
 '\"'
 ]
 .

FUNCTION mysql_real_escape_string RETURNS CHARACTER (INPUT pcString AS CHAR):
    DEF VAR ii AS INTEGER NO-UNDO.

    MESSAGE pcString '->'.

    DO ii = 1 TO EXTENT(cEscape):
         ASSIGN pcString = REPLACE (pcString, cEscape[ii], cReplace[ii]).
    END.

    MESSAGE pcString.

    RETURN pcString.
END.

Progress ABL / 4GL中的输出清理

2 个答案: