{"action":"opened","issue":{"url":"https://api.github.com/repos/OpenSIPS/opensips/issues/473","labels_url":"https://api.github.com/repos/OpenSIPS/opensips/issues/473/labels{/name}","comments_url":"https://api.github.com/repos/OpenSIPS/opensips/issues/473/comments","events_url":"https://api.github.com/repos/OpenSIPS/opensips/issues/473/events","html_url":"https://github.com/OpenSIPS/opensips/issues/473","id":69696645,"number":473,"title":"db_sqlite3 sql statements not escaped","user":{"login":"jarrodb","id":485817,"avatar_url":"https://avatars.githubusercontent.com/u/485817?v=3","gravatar_id":"","url":"https://api.github.com/users/jarrodb","html_url":"https://github.com/jarrodb","followers_url":"https://api.github.com/users/jarrodb/followers","following_url":"https://api.github.com/users/jarrodb/following{/other_user}","gists_url":"https://api.github.com/users/jarrodb/gists{/gist_id}","starred_url":"https://api.github.com/users/jarrodb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jarrodb/subscriptions","organizations_url":"https://api.github.com/users/jarrodb/orgs","repos_url":"https://api.github.com/users/jarrodb/repos","events_url":"https://api.github.com/users/jarrodb/events{/privacy}","received_events_url":"https://api.github.com/users/jarrodb/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-04-20T22:34:50Z","updated_at":"2015-04-20T22:34:50Z","closed_at":null,"body":"#### opensips log error\r\nlocalhost opensips: ERROR:db_sqlite:db_sqlite_insert: failed to prepare: (near \"1.0\": syntax error)\r\nlocalhost opensips: ERROR:db_sqlite:db_sqlite_insert: insert query failed near \"1.0\": syntax error\r\n\r\n#### gdb query\r\n(gdb) print query_holder                                                        \r\n$3 = {                                                                          \r\n  s = 0x852740 <sql_buf> \"insert into presentity (domain,username,event,etag,expires,sender,body,received_time ) values ('sqlite.sipy.org','jarrod','presence','a.1429566087.15836.8.0',1429569706,'','<?xml version='1.0' encodin\"..., len = 655}\r\n\r\n#### synopsis\r\nthe val2str seems to simply use strncpy for appending the the sql buffer which obviously will not escape single quotes.  the preferred method is probably to use bindings to prepared statements (https://www.sqlite.org/c3ref/bind_blob.html) which would entail replacing the values with ? or so and relooping over the value array using the index as the second argument of something like sqlite3_bind_text.  The libsqlite3 also seems to include sqlite3_snprintf and some other functions but they dont appear to be safe.\r\n\r\ngoing home, just reporting this here, thanks.\r\n                       "}}