Fix #929 escaping of raw SQL

Author: mistic100

src/plugins/sql-support/plugin.js

@@ -24,12 +24,12 @@ QueryBuilder.defaults({
         greater_or_equal: { op: '>= ?' },
         between: { op: 'BETWEEN ?', sep: ' AND ' },
         not_between: { op: 'NOT BETWEEN ?', sep: ' AND ' },
-        begins_with: { op: 'LIKE(?)', mod: '{0}%' },
-        not_begins_with: { op: 'NOT LIKE(?)', mod: '{0}%' },
-        contains: { op: 'LIKE(?)', mod: '%{0}%' },
-        not_contains: { op: 'NOT LIKE(?)', mod: '%{0}%' },
-        ends_with: { op: 'LIKE(?)', mod: '%{0}' },
-        not_ends_with: { op: 'NOT LIKE(?)', mod: '%{0}' },
+        begins_with: { op: 'LIKE ?', mod: '{0}%', escape: '%_' },
+        not_begins_with: { op: 'NOT LIKE ?', mod: '{0}%', escape: '%_' },
+        contains: { op: 'LIKE ?', mod: '%{0}%', escape: '%_' },
+        not_contains: { op: 'NOT LIKE ?', mod: '%{0}%', escape: '%_' },
+        ends_with: { op: 'LIKE ?', mod: '%{0}', escape: '%_' },
+        not_ends_with: { op: 'NOT LIKE ?', mod: '%{0}', escape: '%_' },
         is_empty: { op: '= \'\'' },
         is_not_empty: { op: '!= \'\'' },
         is_null: { op: 'IS NULL' },
@@ -307,7 +307,7 @@ QueryBuilder.extend(/** @lends module:plugins.SqlSupport.prototype */ {
                                 v = v ? 1 : 0;
                             }
                             else if (!stmt && rule.type !== 'integer' && rule.type !== 'double' && rule.type !== 'boolean') {
-                                v = Utils.escapeString(v);
+                                v = Utils.escapeString(v, sql.escape);
                             }
 
                             if (sql.mod) {
@@ -579,6 +579,19 @@ QueryBuilder.extend(/** @lends module:plugins.SqlSupport.prototype */ {
                     Utils.error('SQLParse', 'Cannot find field name in {0}', JSON.stringify(data.left));
                 }
 
+                // unescape chars declared by the operator
+                var finalValue = opVal.val;
+                var sql = self.settings.sqlOperators[opVal.op];
+                if (!stmt && sql && sql.escape) {
+                    var searchChars = sql.escape.split('').map(function(c) {
+                        return '\\\\' + c;
+                    }).join('|');
+                    finalValue = finalValue
+                        .replace(new RegExp('(' + searchChars + ')', 'g'), function(s) {
+                            return s[1];
+                        });
+                }
+
                 var id = self.getSQLFieldID(field, value);
 
                 /**
@@ -593,7 +606,7 @@ QueryBuilder.extend(/** @lends module:plugins.SqlSupport.prototype */ {
                     id: id,
                     field: field,
                     operator: opVal.op,
-                    value: opVal.val
+                    value: finalValue
                 }, data);
 
                 curr.rules.push(rule);

src/utils.js

@@ -145,28 +145,39 @@ Utils.changeType = function(value, type) {
 /**
  * Escapes a string like PHP's mysql_real_escape_string does
  * @param {string} value
+ * @param {string} [additionalEscape] additionnal chars to escape
  * @returns {string}
  */
-Utils.escapeString = function(value) {
+Utils.escapeString = function(value, additionalEscape) {
     if (typeof value != 'string') {
         return value;
     }
 
-    return value
+    var escaped = value
         .replace(/[\0\n\r\b\\\'\"]/g, function(s) {
             switch (s) {
                 // @formatter:off
                 case '\0': return '\\0';
                 case '\n': return '\\n';
                 case '\r': return '\\r';
                 case '\b': return '\\b';
+                case '\'': return '\'\'';
                 default:   return '\\' + s;
                 // @formatter:off
             }
         })
         // uglify compliant
         .replace(/\t/g, '\\t')
         .replace(/\x1a/g, '\\Z');
+
+    if (additionalEscape) {
+        escaped = escaped
+            .replace(new RegExp('[' + additionalEscape + ']', 'g'), function(s) {
+                return '\\' + s;
+            });
+    }
+
+    return escaped;
 };
 
 /**