Ticket #470: 470-2.patch

django/core/db/backends/postgresql.py

@@ -53 +53 @@
         if name.startswith('"') and name.endswith('"'):
             return name # Quoting once is enough.
         return '"%s"' % name
+
+    def escapechars(self,rawstring):
+        "Escapes dangerous characters from SQL in a backend-specific way"
+        # important to process backslashes first, otherwise characters are substituted twice!
+        cookedstring = rawstring.replace('\\','\\\\')
+        cookedstring = rawstring.replace("'","''")
+        cookedstring = rawstring.replace('"','\"')
+        cookedstring = rawstring.replace('*','\*')
+        cookedstring = rawstring.replace('_','\_')
+        cookedstring = rawstring.replace(';','\;')
+        return cookedstring
 
 def dictfetchone(cursor):
     "Returns a row from the cursor as a dict"

django/core/db/backends/sqlite3.py

@@ -55 +55 @@
             self.connection.close()
             self.connection = None
 
+    def escapechars(self,rawstring):
+        "Escapes dangerous characters from SQL in a backend-specific way"
+        # sqlite will happily accept a variety of characters without complaint. Single-quotes, however, must be doubled.
+        cookedstring = rawstring.replace("'","''")
+        return cookedstring
+
     def quote_name(self, name):
         if name.startswith('"') and name.endswith('"'):
             return name # Quoting once is enough.

django/core/management.py

@@ -81 +81 @@
                     field_output.append('REFERENCES %s (%s)' % \
                         (db.db.quote_name(f.rel.to.db_table),
                         db.db.quote_name(f.rel.to.get_field(f.rel.field_name).column)))
+                if f.default <> meta.fields.NOT_PROVIDED:
+                    try:
+                        escaped_string = db.db.escapechars("DEFAULT '%s'" % (f.default,))
+                        field_output.append(escaped_string)
+                    except NotImplemented:
+                        pass
                 table_output.append(' '.join(field_output))
         if opts.order_with_respect_to:
             table_output.append('%s %s NULL' % (db.db.quote_name('_order'), db.DATA_TYPES['IntegerField']))