Correct MySQL string literal escaping

core/src/org/labkey/core/dialect/PostgreSqlNonConformingStringHandler.java → api/src/org/labkey/api/data/dialect/BackslashEscapingStringHandler.java

@@ -1,67 +1,59 @@
-/*
- * Copyright (c) 2011-2026 LabKey Corporation
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.labkey.core.dialect;
-
-import org.apache.commons.lang3.StringUtils;
-import org.labkey.api.data.dialect.StandardDialectStringHandler;
-
-/*
-* User: adam
-* Date: Aug 13, 2011
-* Time: 4:10:10 PM
-*/
-
-// Adds support for backslash escaping in string literals
-public class PostgreSqlNonConformingStringHandler extends StandardDialectStringHandler
-{
-    @Override
-    public String quoteStringLiteral(String str)
-    {
-        return "'" + StringUtils.replace(StringUtils.replace(str, "\\", "\\\\"), "'", "''") + "'";
-    }
-
-
-    @Override
-    protected int findEndOfStringLiteral(CharSequence sql, int current)
-    {
-        boolean skipNext = false;
-
-        while (current < sql.length())
-        {
-            char c = sql.charAt(current++);
-
-            if (skipNext)
-            {
-                skipNext = false;
-            }
-            else
-            {
-                if (c == '\\')
-                {
-                    skipNext = true;
-                    continue;
-                }
-                else if (c == '\'')
-                {
-                    break;
-                }
-            }
-        }
-
-        return current;
-    }
-}
+/*
+ * Copyright (c) 2011-2026 LabKey Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.labkey.api.data.dialect;
+
+import org.apache.commons.lang3.Strings;
+
+// Adds support for backslash escaping in string literals
+public class BackslashEscapingStringHandler extends StandardDialectStringHandler
+{
+    @Override
+    public String quoteStringLiteral(String str)
+    {
+        return "'" + Strings.CS.replace(Strings.CS.replace(str, "\\", "\\\\"), "'", "''") + "'";
+    }
+
+
+    @Override
+    protected int findEndOfStringLiteral(CharSequence sql, int current)
+    {
+        boolean skipNext = false;
+
+        while (current < sql.length())
+        {
+            char c = sql.charAt(current++);
+
+            if (skipNext)
+            {
+                skipNext = false;
+            }
+            else
+            {
+                if (c == '\\')
+                {
+                    skipNext = true;
+                }
+                else if (c == '\'')
+                {
+                    break;
+                }
+            }
+        }
+
+        return current;
+    }
+}

api/src/org/labkey/api/data/dialect/SqlDialect.java

@@ -2415,7 +2415,7 @@ void testDialectStringHandler()
         {
             // quotes backslashes etc
             for (String v : Arrays.asList("", "'", "\"", "\\", "''", "\\'", "\\\\'", "'''", "><&/%\\' \"1~\\!@$&'()\"_+{}-=[],.#\u2603\u00E4\u00F6\u00FC\u00C5"))
-                testEquals(v, new SQLFragment("SELECT ").appendStringLiteral(v,d));
+                testEquals(v, new SQLFragment("SELECT ").appendStringLiteral(v, d));
 
             // test things that look like postgres escapes
             //  https://www.postgresql.org/docs/15/sql-syntax-lexical.html#SQL-SYNTAX-STRINGS-ESCAPE

api/src/org/labkey/api/data/dialect/StandardDialectStringHandler.java

@@ -17,6 +17,7 @@
 package org.labkey.api.data.dialect;
 
 import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.lang3.Strings;
 import org.junit.Assert;
 import org.junit.Test;
 import org.labkey.api.data.Parameter;
@@ -28,17 +29,12 @@
 import java.util.LinkedList;
 import java.util.List;
 
-/*
-* User: adam
-* Date: Aug 13, 2011
-* Time: 3:55:55 PM
-*/
 public class StandardDialectStringHandler implements DialectStringHandler
 {
     @Override
     public String quoteStringLiteral(String str)
     {
-        return "'" + StringUtils.replace(str, "'", "''") + "'";
+        return "'" + Strings.CS.replace(str, "'", "''") + "'";
     }
 
 

core/src/org/labkey/core/dialect/PostgreSql92Dialect.java

@@ -38,6 +38,7 @@
 import org.labkey.api.data.TableInfo;
 import org.labkey.api.data.TempTableInClauseGenerator;
 import org.labkey.api.data.TempTableTracker;
+import org.labkey.api.data.dialect.BackslashEscapingStringHandler;
 import org.labkey.api.data.dialect.BasePostgreSqlDialect;
 import org.labkey.api.data.dialect.DialectStringHandler;
 import org.labkey.api.data.dialect.JdbcHelper;
@@ -190,7 +191,7 @@ protected DialectStringHandler createStringHandler()
         if (getStandardConformingStrings())
             return super.createStringHandler();
         else
-            return new PostgreSqlNonConformingStringHandler();
+            return new BackslashEscapingStringHandler();
     }
 
     /*