FS-9652: improve sql sanitization

src/mod/applications/mod_callcenter/mod_callcenter.c

@@ -2379,9 +2379,9 @@ static int members_callback(void *pArg, int argc, char **argv, char **columnName
 		switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_DEBUG, "Queue '%s' changed strategy, adjusting member parameters", queue_name);
 		/* member was ring-all, becomes ring-progressively (no state change because of strategy similarities) */
 		if (!strcasecmp(queue_strategy, "ring-progressively")) {
-			sql = switch_mprintf("UPDATE members SET serving_agent = 'ring-progressively' WHERE uuid = '%s' AND state = '%s' AND serving_agent = 'ring-all'", cbt.member_uuid, cc_member_state2str(CC_MEMBER_STATE_TRYING));
+			sql = switch_mprintf("UPDATE members SET serving_agent = 'ring-progressively' WHERE uuid = '%q' AND state = '%q' AND serving_agent = 'ring-all'", cbt.member_uuid, cc_member_state2str(CC_MEMBER_STATE_TRYING));
 		} else {
-			sql = switch_mprintf("UPDATE members SET serving_agent = '', state = '%s' WHERE uuid = '%s' AND state = '%s' AND serving_agent = 'ring-all'", cc_member_state2str(CC_MEMBER_STATE_WAITING), cbt.member_uuid, cc_member_state2str(CC_MEMBER_STATE_TRYING));
+			sql = switch_mprintf("UPDATE members SET serving_agent = '', state = '%q' WHERE uuid = '%q' AND state = '%q' AND serving_agent = 'ring-all'", cc_member_state2str(CC_MEMBER_STATE_WAITING), cbt.member_uuid, cc_member_state2str(CC_MEMBER_STATE_TRYING));
 		}
 		cc_execute_sql(NULL, sql, NULL);
 		switch_safe_free(sql);
@@ -2391,9 +2391,9 @@ static int members_callback(void *pArg, int argc, char **argv, char **columnName
 		switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_DEBUG, "Queue '%s' changed strategy, adjusting member parameters", queue_name);
 		/* member was ring-progressively, becomes ring-all (no state change because of strategy similarities) */
 		if (!strcasecmp(queue_strategy, "ring-all")) {
-			sql = switch_mprintf("UPDATE members SET serving_agent = 'ring-all' WHERE uuid = '%s' AND state = '%s' AND serving_agent = 'ring-progressively'", cbt.member_uuid, cc_member_state2str(CC_MEMBER_STATE_TRYING));
+			sql = switch_mprintf("UPDATE members SET serving_agent = 'ring-all' WHERE uuid = '%q' AND state = '%q' AND serving_agent = 'ring-progressively'", cbt.member_uuid, cc_member_state2str(CC_MEMBER_STATE_TRYING));
 		} else {
-			sql = switch_mprintf("UPDATE members SET serving_agent = '', state = '%s' WHERE uuid = '%s' AND state = '%s' AND serving_agent = 'ring-progressively'", cc_member_state2str(CC_MEMBER_STATE_WAITING), cbt.member_uuid, cc_member_state2str(CC_MEMBER_STATE_TRYING));
+			sql = switch_mprintf("UPDATE members SET serving_agent = '', state = '%q' WHERE uuid = '%q' AND state = '%q' AND serving_agent = 'ring-progressively'", cc_member_state2str(CC_MEMBER_STATE_WAITING), cbt.member_uuid, cc_member_state2str(CC_MEMBER_STATE_TRYING));
 		}
 		cc_execute_sql(NULL, sql, NULL);
 		switch_safe_free(sql);
@@ -2403,9 +2403,9 @@ static int members_callback(void *pArg, int argc, char **argv, char **columnName
 		switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_DEBUG, "Queue '%s' changed strategy, adjusting member parameters", queue_name);
 		/* member was ring-progressively, its state is already set to TRYING */
 		if (!strcasecmp(serving_agent, "ring-progressively")) {
-			sql = switch_mprintf("UPDATE members SET serving_agent = 'ring-all' WHERE uuid = '%s' AND state = '%s' AND serving_agent = 'ring-progressively'", cbt.member_uuid, cc_member_state2str(CC_MEMBER_STATE_TRYING));
+			sql = switch_mprintf("UPDATE members SET serving_agent = 'ring-all' WHERE uuid = '%q' AND state = '%q' AND serving_agent = 'ring-progressively'", cbt.member_uuid, cc_member_state2str(CC_MEMBER_STATE_TRYING));
 		} else {
-			sql = switch_mprintf("UPDATE members SET serving_agent = 'ring-all', state = '%s' WHERE uuid = '%s' AND state = '%s' AND serving_agent = ''", cc_member_state2str(CC_MEMBER_STATE_TRYING), cbt.member_uuid, cc_member_state2str(CC_MEMBER_STATE_WAITING));
+			sql = switch_mprintf("UPDATE members SET serving_agent = 'ring-all', state = '%q' WHERE uuid = '%q' AND state = '%q' AND serving_agent = ''", cc_member_state2str(CC_MEMBER_STATE_TRYING), cbt.member_uuid, cc_member_state2str(CC_MEMBER_STATE_WAITING));
 		}
 		cc_execute_sql(NULL, sql, NULL);
 		switch_safe_free(sql);
@@ -2415,9 +2415,9 @@ static int members_callback(void *pArg, int argc, char **argv, char **columnName
 		switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_DEBUG, "Queue '%s' changed strategy, adjusting member parameters", queue_name);
 		/* member was ring-all, its state is already set to TRYING */
 		if (!strcasecmp(serving_agent, "ring-all")) {
-			sql = switch_mprintf("UPDATE members SET serving_agent = 'ring-progressively' WHERE uuid = '%s' AND state = '%s' AND serving_agent = 'ring-all'", cbt.member_uuid, cc_member_state2str(CC_MEMBER_STATE_TRYING));
+			sql = switch_mprintf("UPDATE members SET serving_agent = 'ring-progressively' WHERE uuid = '%q' AND state = '%q' AND serving_agent = 'ring-all'", cbt.member_uuid, cc_member_state2str(CC_MEMBER_STATE_TRYING));
 		} else {
-			sql = switch_mprintf("UPDATE members SET serving_agent = 'ring-progressively', state = '%s' WHERE uuid = '%s' AND state = '%s' AND serving_agent = ''", cc_member_state2str(CC_MEMBER_STATE_TRYING), cbt.member_uuid, cc_member_state2str(CC_MEMBER_STATE_WAITING));
+			sql = switch_mprintf("UPDATE members SET serving_agent = 'ring-progressively', state = '%q' WHERE uuid = '%q' AND state = '%q' AND serving_agent = ''", cc_member_state2str(CC_MEMBER_STATE_TRYING), cbt.member_uuid, cc_member_state2str(CC_MEMBER_STATE_WAITING));
 		}
 		cc_execute_sql(NULL, sql, NULL);
 		switch_safe_free(sql);

src/mod/applications/mod_commands/mod_commands.c

@@ -103,7 +103,7 @@ static switch_status_t select_url(const char *user,
 	if (exclude_contact) {
 		sql = switch_mprintf("select url, '%q' "
 							 "from registrations where reg_user='%q' and realm='%q' "
-							 "and url not like '%%%s%%'", (concat != NULL) ? concat : "", user, domain, exclude_contact);
+							 "and url not like '%%%q%%'", (concat != NULL) ? concat : "", user, domain, exclude_contact);
 	} else {
 		sql = switch_mprintf("select url, '%q' "
 							 "from registrations where reg_user='%q' and realm='%q'",
@@ -5409,33 +5409,33 @@ SWITCH_STANDARD_API(show_function)
 		if (end_of(command) == 's') {
 			end_of(command) = '\0';
 		}
-		sprintf(sql, "select type, name, ikey from interfaces where hostname='%s' and type = '%s' order by type,name", switch_core_get_hostname(), command);
+		switch_snprintfv(sql, sizeof(sql), "select type, name, ikey from interfaces where hostname='%q' and type = '%q' order by type,name", switch_core_get_hostname(), command);
 	} else if (!strncasecmp(command, "module", 6)) {
 		if (argv[1] && strcasecmp(argv[1], "as")) {
-			sprintf(sql, "select distinct type, name, ikey, filename from interfaces where hostname='%s' and ikey = '%s' order by type,name",
+			switch_snprintfv(sql, sizeof(sql), "select distinct type, name, ikey, filename from interfaces where hostname='%q' and ikey = '%q' order by type,name",
 					switch_core_get_hostname(), argv[1]);
 		} else {
-			sprintf(sql, "select distinct type, name, ikey, filename from interfaces where hostname='%s' order by type,name", switch_core_get_hostname());
+			switch_snprintfv(sql, sizeof(sql), "select distinct type, name, ikey, filename from interfaces where hostname='%q' order by type,name", switch_core_get_hostname());
 		}
 	} else if (!strcasecmp(command, "interfaces")) {
-		sprintf(sql, "select type, name, ikey from interfaces where hostname='%s' order by type,name", switch_core_get_hostname());
+		switch_snprintfv(sql, sizeof(sql), "select type, name, ikey from interfaces where hostname='%q' order by type,name", switch_core_get_hostname());
 	} else if (!strcasecmp(command, "interface_types")) {
-		sprintf(sql, "select type,count(type) as total from interfaces where hostname='%s' group by type order by type", switch_core_get_switchname());
+		switch_snprintfv(sql, sizeof(sql), "select type,count(type) as total from interfaces where hostname='%q' group by type order by type", switch_core_get_switchname());
 	} else if (!strcasecmp(command, "tasks")) {
-		sprintf(sql, "select * from %s where hostname='%s'", command, switch_core_get_hostname());
+		switch_snprintfv(sql, sizeof(sql), "select * from %q where hostname='%q'", command, switch_core_get_hostname());
 	} else if (!strcasecmp(command, "application") || !strcasecmp(command, "api")) {
 		if (argv[1] && strcasecmp(argv[1], "as")) {
-			sprintf(sql,
-					"select name, description, syntax, ikey from interfaces where hostname='%s' and type = '%s' and description != '' and name = '%s' order by type,name",
+			switch_snprintfv(sql, sizeof(sql),
+					"select name, description, syntax, ikey from interfaces where hostname='%q' and type = '%q' and description != '' and name = '%q' order by type,name",
 					switch_core_get_hostname(), command, argv[1]);
 		} else {
-			sprintf(sql, "select name, description, syntax, ikey from interfaces where hostname='%s' and type = '%s' and description != '' order by type,name", switch_core_get_hostname(), command);
+			switch_snprintfv(sql, sizeof(sql), "select name, description, syntax, ikey from interfaces where hostname='%q' and type = '%q' and description != '' order by type,name", switch_core_get_hostname(), command);
 		}
 	/* moved refreshable webpage show commands i.e. show calls|registrations|channels||detailed_calls|bridged_calls|detailed_bridged_calls */
 	} else if (!strcasecmp(command, "aliases")) {
-		sprintf(sql, "select * from aliases where hostname='%s' order by alias", switch_core_get_switchname());
+		switch_snprintfv(sql, sizeof(sql), "select * from aliases where hostname='%q' order by alias", switch_core_get_switchname());
 	} else if (!strcasecmp(command, "complete")) {
-		sprintf(sql, "select * from complete where hostname='%s' order by a1,a2,a3,a4,a5,a6,a7,a8,a9,a10", switch_core_get_switchname());
+		switch_snprintfv(sql, sizeof(sql), "select * from complete where hostname='%q' order by a1,a2,a3,a4,a5,a6,a7,a8,a9,a10", switch_core_get_switchname());
 	} else if (!strncasecmp(command, "help", 4)) {
 		char *cmdname = NULL;
 
@@ -5444,18 +5444,18 @@ SWITCH_STANDARD_API(show_function)
 		if ((cmdname = strchr(command, ' ')) && strcasecmp(cmdname, "as")) {
 			*cmdname++ = '\0';
 			switch_snprintfv(sql, sizeof(sql),
-							"select name, syntax, description, ikey from interfaces where hostname='%s' and type = 'api' and name = '%q' order by name",
+							"select name, syntax, description, ikey from interfaces where hostname='%q' and type = 'api' and name = '%q' order by name",
 							switch_core_get_hostname(), cmdname);
 		} else {
 			switch_snprintfv(sql, sizeof(sql), "select name, syntax, description, ikey from interfaces where hostname='%q' and type = 'api' order by name", switch_core_get_hostname());
 		}
 	} else if (!strcasecmp(command, "nat_map")) {
-		switch_snprintf(sql, sizeof(sql) - 1,
+		switch_snprintfv(sql, sizeof(sql) - 1,
 						"SELECT port, "
 						"  CASE proto "
 						"	WHEN 0 THEN 'udp' "
 						"	WHEN 1 THEN 'tcp' "
-						"	ELSE 'unknown' " "  END AS proto, " "  proto AS proto_num, " "  sticky " " FROM nat where hostname='%s' ORDER BY port, proto", switch_core_get_hostname());
+						"	ELSE 'unknown' " "  END AS proto, " "  proto AS proto_num, " "  sticky " " FROM nat where hostname='%q' ORDER BY port, proto", switch_core_get_hostname());
 	} else {
 		/* from here on refreshable commands: calls|registrations|channels||detailed_calls|bridged_calls|detailed_bridged_calls */
 		if (holder.format->api) {
@@ -5474,18 +5474,18 @@ SWITCH_STANDARD_API(show_function)
 		}
 
 		if (!strcasecmp(command, "calls")) {
-			sprintf(sql, "select * from basic_calls where hostname='%s' order by call_created_epoch", switch_core_get_switchname());
+			switch_snprintfv(sql, sizeof(sql), "select * from basic_calls where hostname='%q' order by call_created_epoch", switch_core_get_switchname());
 			if (argv[1] && !strcasecmp(argv[1], "count")) {
-				sprintf(sql, "select count(*) from basic_calls where hostname='%s'", switch_core_get_switchname());
+				switch_snprintfv(sql, sizeof(sql), "select count(*) from basic_calls where hostname='%q'", switch_core_get_switchname());
 				holder.justcount = 1;
 				if (argv[3] && !strcasecmp(argv[2], "as")) {
 					as = argv[3];
 				}
 			}
 		} else if (!strcasecmp(command, "registrations")) {
-			sprintf(sql, "select * from registrations where hostname='%s'", switch_core_get_switchname());
+			switch_snprintfv(sql, sizeof(sql), "select * from registrations where hostname='%q'", switch_core_get_switchname());
 			if (argv[1] && !strcasecmp(argv[1], "count")) {
-				sprintf(sql, "select count(*) from registrations where hostname='%s'", switch_core_get_switchname());
+				switch_snprintfv(sql, sizeof(sql), "select count(*) from registrations where hostname='%q'", switch_core_get_switchname());
 				holder.justcount = 1;
 				if (argv[3] && !strcasecmp(argv[2], "as")) {
 					as = argv[3];
@@ -5500,41 +5500,41 @@ SWITCH_STANDARD_API(show_function)
 					}
 				}
 				if (strchr(argv[2], '%')) {
-					sprintf(sql,
-						"select * from channels where hostname='%s' and uuid like '%s' or name like '%s' or cid_name like '%s' or cid_num like '%s' or presence_data like '%s' or accountcode like '%s' order by created_epoch",
+					switch_snprintfv(sql, sizeof(sql),
+						"select * from channels where hostname='%q' and uuid like '%q' or name like '%q' or cid_name like '%q' or cid_num like '%q' or presence_data like '%q' or accountcode like '%q' order by created_epoch",
 						switch_core_get_switchname(), argv[2], argv[2], argv[2], argv[2], argv[2], argv[2]);
 				} else {
-					sprintf(sql,
-						"select * from channels where hostname='%s' and uuid like '%%%s%%' or name like '%%%s%%' or cid_name like '%%%s%%' or cid_num like '%%%s%%' or presence_data like '%%%s%%' or accountcode like '%%%s%%' order by created_epoch",
+					switch_snprintfv(sql, sizeof(sql),
+						"select * from channels where hostname='%q' and uuid like '%%%q%%' or name like '%%%q%%' or cid_name like '%%%q%%' or cid_num like '%%%q%%' or presence_data like '%%%q%%' or accountcode like '%%%q%%' order by created_epoch",
 						switch_core_get_switchname(), argv[2], argv[2], argv[2], argv[2], argv[2], argv[2]);
 				}
 				if (argv[4] && !strcasecmp(argv[3], "as")) {
 					as = argv[4];
 				}
 			} else {
-				sprintf(sql, "select * from channels where hostname='%s' order by created_epoch", switch_core_get_switchname());
+				switch_snprintfv(sql, sizeof(sql), "select * from channels where hostname='%q' order by created_epoch", switch_core_get_switchname());
 			}
 		} else if (!strcasecmp(command, "channels")) {
-			sprintf(sql, "select * from channels where hostname='%s' order by created_epoch", switch_core_get_switchname());
+			switch_snprintfv(sql, sizeof(sql), "select * from channels where hostname='%q' order by created_epoch", switch_core_get_switchname());
 			if (argv[1] && !strcasecmp(argv[1], "count")) {
-				sprintf(sql, "select count(*) from channels where hostname='%s'", switch_core_get_switchname());
+				switch_snprintfv(sql, sizeof(sql), "select count(*) from channels where hostname='%q'", switch_core_get_switchname());
 				holder.justcount = 1;
 				if (argv[3] && !strcasecmp(argv[2], "as")) {
 					as = argv[3];
 				}
 			}
 		} else if (!strcasecmp(command, "detailed_calls")) {
-			sprintf(sql, "select * from detailed_calls where hostname='%s' order by created_epoch", switch_core_get_switchname());
+			switch_snprintfv(sql, sizeof(sql), "select * from detailed_calls where hostname='%q' order by created_epoch", switch_core_get_switchname());
 			if (argv[2] && !strcasecmp(argv[1], "as")) {
 				as = argv[2];
 			}
 		} else if (!strcasecmp(command, "bridged_calls")) {
-			sprintf(sql, "select * from basic_calls where b_uuid is not null and hostname='%s' order by created_epoch", switch_core_get_switchname());
+			switch_snprintfv(sql, sizeof(sql), "select * from basic_calls where b_uuid is not null and hostname='%q' order by created_epoch", switch_core_get_switchname());
 			if (argv[2] && !strcasecmp(argv[1], "as")) {
 				as = argv[2];
 			}
 		} else if (!strcasecmp(command, "detailed_bridged_calls")) {
-			sprintf(sql, "select * from detailed_calls where b_uuid is not null and hostname='%s' order by created_epoch", switch_core_get_switchname());
+			switch_snprintfv(sql, sizeof(sql), "select * from detailed_calls where b_uuid is not null and hostname='%q' order by created_epoch", switch_core_get_switchname());
 			if (argv[2] && !strcasecmp(argv[1], "as")) {
 				as = argv[2];
 			}

src/mod/applications/mod_directory/mod_directory.c

@@ -863,14 +863,17 @@ switch_status_t navigate_entrys(switch_core_session_t *session, dir_profile_t *p
 	cbt.len = sizeof(entry_count);
 
 	if (params->search_by == SEARCH_BY_FIRST_AND_LAST_NAME) {
-		sql_where = switch_mprintf("hostname = '%q' and uuid = '%q' and name_visible = 1 and (%s like '%q%%' or %s like '%q%%')",
+		sql_where = switch_mprintf("hostname = '%q' and uuid = '%q' and name_visible = 1 and (%q like '%q%%' or %q like '%q%%')",
 				globals.hostname, switch_core_session_get_uuid(session), "last_name_digit", params->digits, "first_name_digit", params->digits);
 	} else if (params->search_by == SEARCH_BY_FULL_NAME) {
 		sql_where = switch_mprintf("hostname = '%q' and uuid = '%q' and name_visible = 1 and full_name_digit like '%%%q%%'",
-				globals.hostname, switch_core_session_get_uuid(session), "last_name_digit", params->digits, "first_name_digit", params->digits);
+				globals.hostname, switch_core_session_get_uuid(session), params->digits);
+	} else if (params->search_by == SEARCH_BY_LAST_NAME) {
+		sql_where = switch_mprintf("hostname = '%q' and uuid = '%q' and name_visible = 1 and last_name_digit like '%q%%'",
+				globals.hostname, switch_core_session_get_uuid(session), params->digits);
 	} else {
-		sql_where = switch_mprintf("hostname = '%q' and uuid = '%q' and name_visible = 1 and %s like '%q%%'",
-				globals.hostname, switch_core_session_get_uuid(session), (params->search_by == SEARCH_BY_LAST_NAME ? "last_name_digit" : "first_name_digit"), params->digits);
+		sql_where = switch_mprintf("hostname = '%q' and uuid = '%q' and name_visible = 1 and first_name_digit like '%q%%'",
+				globals.hostname, switch_core_session_get_uuid(session), params->digits);
 	}
 
 	sql = switch_mprintf("select count(*) from (select distinct first_name, last_name, extension from directory_search where %s) AS dsearch", sql_where);

src/mod/applications/mod_fifo/mod_fifo.c

@@ -1619,7 +1619,7 @@ static void *SWITCH_THREAD_FUNC outbound_ringall_thread_run(switch_thread_t *thr
 
 	for (i = 0; i < cbh->rowcount; i++) {
 		struct call_helper *h = cbh->rows[i];
-		char *sql = switch_mprintf("update fifo_outbound set ring_count=ring_count+1 where uuid='%s'", h->uuid);
+		char *sql = switch_mprintf("update fifo_outbound set ring_count=ring_count+1 where uuid='%q'", h->uuid);
 
 		fifo_execute_sql_queued(&sql, SWITCH_TRUE, SWITCH_TRUE);
 	}
@@ -1844,7 +1844,7 @@ static void *SWITCH_THREAD_FUNC outbound_enterprise_thread_run(switch_thread_t *
 		switch_event_fire(&event);
 	}
 
-	sql = switch_mprintf("update fifo_outbound set ring_count=ring_count+1 where uuid='%s'", h->uuid);
+	sql = switch_mprintf("update fifo_outbound set ring_count=ring_count+1 where uuid='%q'", h->uuid);
 	fifo_execute_sql_queued(&sql, SWITCH_TRUE, SWITCH_TRUE);
 
 	status = switch_ivr_originate(NULL, &session, &cause, originate_string, h->timeout, NULL, NULL, NULL, NULL, ovars, SOF_NONE, NULL);
@@ -3358,7 +3358,7 @@ SWITCH_STANDARD_APP(fifo_function)
 					cancel_consumer_outbound_call(outbound_id, SWITCH_CAUSE_ORIGINATOR_CANCEL);
 					add_bridge_call(outbound_id);
 
-					sql = switch_mprintf("update fifo_outbound set stop_time=0,start_time=%ld,use_count=use_count+1,outbound_fail_count=0 where uuid='%s'",
+					sql = switch_mprintf("update fifo_outbound set stop_time=0,start_time=%ld,use_count=use_count+1,outbound_fail_count=0 where uuid='%q'",
 										 switch_epoch_time_now(NULL), outbound_id);
 
 					fifo_execute_sql_queued(&sql, SWITCH_TRUE, SWITCH_TRUE);
@@ -3439,7 +3439,7 @@ SWITCH_STANDARD_APP(fifo_function)
 
 					sql = switch_mprintf("update fifo_outbound set stop_time=%ld, use_count=use_count-1, "
 										 "outbound_call_total_count=outbound_call_total_count+1, "
-										 "outbound_call_count=outbound_call_count+1, next_avail=%ld + lag + 1 where uuid='%s' and use_count > 0",
+										 "outbound_call_count=outbound_call_count+1, next_avail=%ld + lag + 1 where uuid='%q' and use_count > 0",
 										 now, now, outbound_id);
 
 					fifo_execute_sql_queued(&sql, SWITCH_TRUE, SWITCH_TRUE);
@@ -3788,7 +3788,7 @@ static int xml_outbound(switch_xml_t xml, fifo_node_t *node, char *container, ch
 	char *sql;
 
 	if (!strcmp(node->name, MANUAL_QUEUE_NAME)) {
-		sql = switch_mprintf("select uuid, '%s', originate_string, simo_count, use_count, timeout,"
+		sql = switch_mprintf("select uuid, '%q', originate_string, simo_count, use_count, timeout,"
 							 "lag, next_avail, expires, static, outbound_call_count, outbound_fail_count,"
 							 "hostname, taking_calls, status, outbound_call_total_count, outbound_fail_total_count, active_time, inactive_time,"
 							 "manual_calls_out_count, manual_calls_in_count, manual_calls_out_total_count, manual_calls_in_total_count from fifo_outbound "

src/mod/applications/mod_nibblebill/mod_nibblebill.c

@@ -387,7 +387,7 @@ static switch_bool_t bill_event(double billamount, const char *billaccount, swit
 			sql = globals.custom_sql_save;
 		}
 	} else {
-		sql = dsql = switch_mprintf("UPDATE %s SET %s=%s- %f WHERE %s='%s'", globals.db_table, globals.db_column_cash,
+		sql = dsql = switch_mprintf("UPDATE %q SET %q=%q- %f WHERE %q='%q'", globals.db_table, globals.db_column_cash,
 									globals.db_column_cash, billamount, globals.db_column_account, billaccount);
 		
 	}
@@ -415,7 +415,7 @@ static double get_balance(const char *billaccount, switch_channel_t *channel)
 			sql = globals.custom_sql_lookup;
 		}
 	} else {
-		sql = dsql = switch_mprintf("SELECT %s AS nibble_balance FROM %s WHERE %s='%s'", 
+		sql = dsql = switch_mprintf("SELECT %q AS nibble_balance FROM %q WHERE %q='%q'", 
 									globals.db_column_cash, globals.db_table, globals.db_column_account, billaccount);
 	}
 

src/mod/applications/mod_snom/mod_snom.c

@@ -172,7 +172,7 @@ SWITCH_STANDARD_API(snom_command_api_function)
 			goto end;
 		}
 
-		sql = switch_mprintf("select network_ip from registrations where url = '%s'", apiresp);
+		sql = switch_mprintf("select network_ip from registrations where url = '%q'", apiresp);
 
 		ret = switch_cache_db_execute_sql2str(db, sql, host, sizeof(host), NULL);
 		switch_safe_free(sql);

src/mod/applications/mod_voicemail/mod_voicemail.c

@@ -1778,7 +1778,7 @@ static switch_status_t listen_file(switch_core_session_t *session, vm_profile_t
 				}
 
 			} else if (!strcmp(input, profile->delete_file_key) || (!strcmp(input, profile->email_key) && !zstr(cbt->email))) {
-				char *sql = switch_mprintf("update voicemail_msgs set flags='delete' where uuid='%s'", cbt->uuid);
+				char *sql = switch_mprintf("update voicemail_msgs set flags='delete' where uuid='%q'", cbt->uuid);
 				vm_execute_sql(profile, sql, profile->mutex);
 				switch_safe_free(sql);
 				if (!strcmp(input, profile->email_key) && !zstr(cbt->email)) {
@@ -1891,7 +1891,7 @@ static switch_status_t listen_file(switch_core_session_t *session, vm_profile_t
 					TRY_CODE(switch_ivr_phrase_macro(session, VM_ACK_MACRO, "deleted", NULL, NULL));
 				}
 			} else {
-				char *sql = switch_mprintf("update voicemail_msgs set flags='save' where uuid='%s'", cbt->uuid);
+				char *sql = switch_mprintf("update voicemail_msgs set flags='save' where uuid='%q'", cbt->uuid);
 				vm_execute_sql(profile, sql, profile->mutex);
 				switch_safe_free(sql);
 				TRY_CODE(switch_ivr_phrase_macro(session, VM_ACK_MACRO, "saved", NULL, NULL));
@@ -2119,7 +2119,7 @@ static void voicemail_check_main(switch_core_session_t *session, vm_profile_t *p
 				switch (play_msg_type) {
 				case MSG_NEW:
 					{
-						switch_snprintf(sql, sizeof(sql),
+						switch_snprintfv(sql, sizeof(sql),
 										"select created_epoch, read_epoch, username, domain, uuid, cid_name, cid_number, in_folder, file_path, message_len, flags, read_flags, forwarded_by from voicemail_msgs where username='%s' and domain='%s' and read_epoch=0"
 										" order by read_flags, created_epoch %s", myid, domain_name,
 										profile->play_new_messages_lifo ? "desc" : "asc");
@@ -2130,7 +2130,7 @@ static void voicemail_check_main(switch_core_session_t *session, vm_profile_t *p
 				case MSG_SAVED:
 				default:
 					{
-						switch_snprintf(sql, sizeof(sql),
+						switch_snprintfv(sql, sizeof(sql),
 										"select created_epoch, read_epoch, username, domain, uuid, cid_name, cid_number, in_folder, file_path, message_len, flags, read_flags, forwarded_by from voicemail_msgs where username='%s' and domain='%s' and read_epoch !=0"
 										" order by read_flags, created_epoch %s", myid, domain_name,
 										profile->play_saved_messages_lifo ? "desc" : "asc");
@@ -2163,8 +2163,8 @@ static void voicemail_check_main(switch_core_session_t *session, vm_profile_t *p
 						break;
 					}
 				}
-				switch_snprintf(sql, sizeof(sql), "update voicemail_msgs set read_epoch=%ld where read_epoch=0 and "
-								"username='%s' and domain='%s' and flags='save'",
+				switch_snprintfv(sql, sizeof(sql), "update voicemail_msgs set read_epoch=%ld where read_epoch=0 and "
+								"username='%q' and domain='%q' and flags='save'",
 								(long) switch_epoch_time_now(NULL), myid, domain_name);
 				vm_execute_sql(profile, sql, profile->mutex);
 				switch_snprintfv(sql, sizeof(sql), "select file_path from voicemail_msgs where username='%q' and domain='%q' and flags='delete'", myid,
@@ -2242,11 +2242,11 @@ static void voicemail_check_main(switch_core_session_t *session, vm_profile_t *p
 						TRY_CODE(switch_ivr_phrase_macro(session, VM_CHOOSE_GREETING_SELECTED_MACRO, input, NULL, NULL));
 						if (file_path == NULL) {
 							sql =
-								switch_mprintf("update voicemail_prefs set greeting_path=NULL where username='%s' and domain='%s'", myid,
+								switch_mprintf("update voicemail_prefs set greeting_path=NULL where username='%q' and domain='%q'", myid,
 										   domain_name);
 						} else {
 							sql =
-								switch_mprintf("update voicemail_prefs set greeting_path='%s' where username='%s' and domain='%s'",
+								switch_mprintf("update voicemail_prefs set greeting_path='%q' where username='%q' and domain='%q'",
 										   file_path, myid, domain_name);
 						}
 						vm_execute_sql(profile, sql, profile->mutex);
@@ -2282,7 +2282,7 @@ static void voicemail_check_main(switch_core_session_t *session, vm_profile_t *p
 						switch_file_rename(tmp_file_path, file_path, switch_core_session_get_pool(session));
 						
 						sql =
-							switch_mprintf("update voicemail_prefs set greeting_path='%s' where username='%s' and domain='%s'", file_path, myid,
+							switch_mprintf("update voicemail_prefs set greeting_path='%q' where username='%q' and domain='%q'", file_path, myid,
 										   domain_name);
 						vm_execute_sql(profile, sql, profile->mutex);
 						switch_safe_free(sql);
@@ -2341,7 +2341,7 @@ static void voicemail_check_main(switch_core_session_t *session, vm_profile_t *p
 							switch_ivr_phrase_macro(session, VM_CHANGE_PASS_FAIL_MACRO, NULL, NULL, NULL);
 							switch_event_destroy(&params);
 						} else {
-							sql = switch_mprintf("update voicemail_prefs set password='%s' where username='%s' and domain='%s'", buf, myid, domain_name);
+							sql = switch_mprintf("update voicemail_prefs set password='%q' where username='%q' and domain='%q'", buf, myid, domain_name);
 							vm_execute_sql(profile, sql, profile->mutex);
 							switch_safe_free(file_path);
 							switch_safe_free(sql);
@@ -2359,7 +2359,7 @@ static void voicemail_check_main(switch_core_session_t *session, vm_profile_t *p
 					unlink(tmp_file_path);
 					TRY_CODE(create_file(session, profile, VM_RECORD_NAME_MACRO, file_path, &message_len, SWITCH_FALSE, NULL, NULL));
 					switch_file_rename(tmp_file_path, file_path, switch_core_session_get_pool(session));
-					sql = switch_mprintf("update voicemail_prefs set name_path='%s' where username='%s' and domain='%s'", file_path, myid, domain_name);
+					sql = switch_mprintf("update voicemail_prefs set name_path='%q' where username='%q' and domain='%q'", file_path, myid, domain_name);
 					vm_execute_sql(profile, sql, profile->mutex);
 					switch_safe_free(tmp_file_path);
 					switch_safe_free(sql);
@@ -4240,13 +4240,13 @@ static void do_play(vm_profile_t *profile, char *user_in, char *domain, char *fi
 
 	user = resolve_id(user_in, domain, "web-vm");
 
-	sql = switch_mprintf("update voicemail_msgs set read_epoch=%ld where username='%s' and domain='%s' and file_path like '%%%s'",
+	sql = switch_mprintf("update voicemail_msgs set read_epoch=%ld where username='%q' and domain='%q' and file_path like '%%%q'",
 						 (long) switch_epoch_time_now(NULL), user, domain, file);
 
 	vm_execute_sql(profile, sql, profile->mutex);
 	free(sql);
 
-	sql = switch_mprintf("select created_epoch, read_epoch, username, domain, uuid, cid_name, cid_number, in_folder, file_path, message_len, flags, read_flags, forwarded_by from voicemail_msgs where username='%s' and domain='%s' and file_path like '%%%s' order by created_epoch",
+	sql = switch_mprintf("select created_epoch, read_epoch, username, domain, uuid, cid_name, cid_number, in_folder, file_path, message_len, flags, read_flags, forwarded_by from voicemail_msgs where username='%q' and domain='%q' and file_path like '%%%q' order by created_epoch",
 						 user, domain, file);
 	memset(&holder, 0, sizeof(holder));
 	holder.profile = profile;
@@ -4272,7 +4272,7 @@ static void do_del(vm_profile_t *profile, char *user_in, char *domain, char *fil
 		ref = switch_event_get_header(stream->param_event, "http-referer");
 	}
 
-	sql = switch_mprintf("select created_epoch, read_epoch, username, domain, uuid, cid_name, cid_number, in_folder, file_path, message_len, flags, read_flags, forwarded_by from voicemail_msgs where username='%s' and domain='%s' and file_path like '%%%s' order by created_epoch",
+	sql = switch_mprintf("select created_epoch, read_epoch, username, domain, uuid, cid_name, cid_number, in_folder, file_path, message_len, flags, read_flags, forwarded_by from voicemail_msgs where username='%q' and domain='%q' and file_path like '%%%q' order by created_epoch",
 						 user, domain, file);
 	memset(&holder, 0, sizeof(holder));
 	holder.profile = profile;
@@ -4280,7 +4280,7 @@ static void do_del(vm_profile_t *profile, char *user_in, char *domain, char *fil
 	vm_execute_sql_callback(profile, profile->mutex, sql, del_callback, &holder);
 
 	switch_safe_free(sql);
-	sql = switch_mprintf("delete from voicemail_msgs where username='%s' and domain='%s' and file_path like '%%%s'", user, domain, file);
+	sql = switch_mprintf("delete from voicemail_msgs where username='%q' and domain='%q' and file_path like '%%%q'", user, domain, file);
 	vm_execute_sql(profile, sql, profile->mutex);
 	free(sql);
 
@@ -4537,7 +4537,7 @@ static void do_rss(vm_profile_t *profile, char *user, char *domain, char *host,
 	x_tmp = switch_xml_add_child_d(holder.x_channel, "ttl", 0);
 	switch_xml_set_txt_d(x_tmp, "15");
 
-	sql = switch_mprintf("select created_epoch, read_epoch, username, domain, uuid, cid_name, cid_number, in_folder, file_path, message_len, flags, read_flags, forwarded_by from voicemail_msgs where username='%s' and domain='%s' order by read_flags, created_epoch", user, domain);
+	sql = switch_mprintf("select created_epoch, read_epoch, username, domain, uuid, cid_name, cid_number, in_folder, file_path, message_len, flags, read_flags, forwarded_by from voicemail_msgs where username='%q' and domain='%q' order by read_flags, created_epoch", user, domain);
 	vm_execute_sql_callback(profile, profile->mutex, sql, rss_callback, &holder);
 
 	xmlstr = switch_xml_toxml(holder.xml, SWITCH_TRUE);
@@ -4580,11 +4580,11 @@ static void do_web(vm_profile_t *profile, const char *user_in, const char *domai
 	cbt.buf = buf;
 	cbt.len = sizeof(buf);
 
-	sql = switch_mprintf("select created_epoch, read_epoch, username, domain, uuid, cid_name, cid_number, in_folder, file_path, message_len, flags, read_flags, forwarded_by from voicemail_msgs where username='%s' and domain='%s' order by read_flags, created_epoch", user, domain);
+	sql = switch_mprintf("select created_epoch, read_epoch, username, domain, uuid, cid_name, cid_number, in_folder, file_path, message_len, flags, read_flags, forwarded_by from voicemail_msgs where username='%q' and domain='%q' order by read_flags, created_epoch", user, domain);
 	vm_execute_sql_callback(profile, profile->mutex, sql, web_callback, &holder);
 	switch_safe_free(sql);
 
-	sql = switch_mprintf("select count(*) from voicemail_msgs where username='%s' and domain='%s' order by read_flags", user, domain);
+	sql = switch_mprintf("select count(*) from voicemail_msgs where username='%q' and domain='%q' order by read_flags", user, domain);
 	vm_execute_sql_callback(profile, profile->mutex, sql, sql2str_callback, &cbt);
 	switch_safe_free(sql);