/* * call-seq: * conn.escape_string( str ) -> String * PGconn.escape_string( str ) -> String # DEPRECATED * * Connection instance method for versions of 8.1 and higher of libpq * uses PQescapeStringConn, which is safer. Avoid calling as a class method, * the class method uses the deprecated PQescapeString() API function. * * Returns a SQL-safe version of the String _str_. * This is the preferred way to make strings safe for inclusion in * SQL queries. * * Consider using exec_params, which avoids the need for passing values * inside of SQL commands. */ static VALUE pgconn_s_escape(VALUE self, VALUE string) { char *escaped; int size,error; VALUE result; Check_Type(string, T_STRING); escaped = ALLOC_N(char, RSTRING_LEN(string) * 2 + 1); if(CLASS_OF(self) == rb_cPGconn) { size = PQescapeStringConn(get_pgconn(self), escaped, RSTRING_PTR(string), RSTRING_LEN(string), &error); if(error) { rb_raise(rb_ePGError, PQerrorMessage(get_pgconn(self))); } } else { size = PQescapeString(escaped, RSTRING_PTR(string), RSTRING_LEN(string)); } result = rb_str_new(escaped, size); free(escaped); OBJ_INFECT(result, string); return result; }