GithubStar/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-10-17 05:07:28 +08:00
Code Issues Packages Projects Releases Wiki Activity

Minor patch

Browse Source
This commit is contained in:
Miroslav Štampar
2026-08-04 23:12:27 +02:00
parent dbe2734b71
commit ede662eca6
2 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/dbms/mssqlserver/syntax.py
+14 -1
View File
@@ -16,9 +16,22 @@ class Syntax(GenericSyntax):
True
>>> Syntax.escape(u"SELECT 'abcd\xebfgh' FROM foobar") == "SELECT CHAR(97)+CHAR(98)+CHAR(99)+CHAR(100)+NCHAR(235)+CHAR(102)+CHAR(103)+CHAR(104) FROM foobar"
True
>>> Syntax.escape(u"SELECT '\U0001f600' FROM foobar") == "SELECT NCHAR(55357)+NCHAR(56832) FROM foobar"
True
"""
def escaper(value):
return "+".join("%s(%d)" % ("CHAR" if _ < 128 else "NCHAR", _) for _ in getOrds(value))
chars = []
for _ in getOrds(value):
if _ < 128:
chars.append("CHAR(%d)" % _)
elif _ < 0x10000:
chars.append("NCHAR(%d)" % _)
else:
_ -= 0x10000
chars.append("NCHAR(%d)+NCHAR(%d)" % (0xd800 + (_ >> 10), 0xdc00 + (_ & 0x3ff))) # SQL Server's NCHAR() only accepts BMP values without SC collation, so split into a surrogate pair
return "+".join(chars)
return Syntax._escape(expression, quote, escaper)